Claude traces NIST’s elliptic-curve seeds to 1990s timestamps

The story

Anthropic says an internal Claude research model has reconstructed the origin of cryptographic seed values that have puzzled specialists for more than 25 years. The seeds accompanied elliptic curves published in the U.S. National Institute of Standards and Technology’s FIPS 186-2 digital-signature standard. According to Anthropic, they were not hashes of a hidden phrase, as one long-running account suggested, but outputs from the C library’s lrand48 pseudorandom-number generator started with Unix timestamps.

The result covers the prime curves P-192, P-224, P-256, P-384 and P-521, plus four binary curves. Anthropic published a short Python program that regenerates the NIST values. CellCog, an independent AI company, reported running that code and matching all nine covered seeds in FIPS 186-2 character for character, including a control in which stopping one candidate early did not match. That reproducibility is central: the new account can be checked directly rather than accepted on the authority of the model or its developer.

NIST’s January 2000 standard specified ECDSA and recommended elliptic curves for federal use. A published seed is hashed to help derive a curve coefficient, allowing users to verify that the curve follows from the disclosed starting value. What the document did not explain was how the National Security Agency had selected those seeds. That missing first step left room for speculation that a party with advanced mathematical knowledge might have searched for unusually weak parameters and then presented a seed that made the choice look random.

Cryptographers Neal Koblitz and Alfred Menezes documented the history and controversy in a 2015 paper. A more benign explanation attributed to NSA mathematician Jerry Solinas held that the seeds came from repeatedly hashing a joke phrase, but the phrase and generation code were lost. A public bounty eventually reached $36,864 for a reproducible answer. Anthropic says several employees pursued the phrase theory without success before a researcher gave an internal Claude model the open-ended problem in October.

Claude approached the numbers as traces of 1990s software. It tested whether adjacent parts of the published seeds resembled outputs from older random-number generators. A pattern of zero high bits pointed toward lrand48, which maintains a 48-bit state and returns 31 output bits. For the more truncated prime-curve outputs, the model used Lenstra–Lenstra–Lovász lattice reduction to recover candidate internal states. It then ran the generator backward to states consistent with srand48 initialization.

Those states decoded to clock times between May 1997 and April 1998. In the reconstructed recipe, the generator produced 20-byte candidates until one became the published seed. P-256, for example, appears as candidate 1,842 from a run started at 01:52:34 UTC on August 16, 1997. Matching a full 160-bit seed provides far stronger evidence than noticing a superficial numerical resemblance. Anthropic also traced six curve base points to the generator in the FreeLIP arithmetic package.

The limits are just as important as the result. This is not a method for recovering ECDSA private keys, forging signatures or breaking encrypted traffic. The seed is a public parameter used in defining a standard curve; it is not a secret key. Anthropic explicitly says no migration or operational change is required. The simple, reproducible generation process makes intentional subversion less plausible because it sharply narrows how the parameters could have been manipulated without leaving a detectable search trail.

The work does not close every provenance question. The seed for B-163 remains unexplained. So do the base points for P-224, P-256, P-384 and P-521, and Anthropic notes that some usable candidate curves were skipped before the standardized ones were chosen. Those gaps do not demonstrate a weakness, but they mean the historical reconstruction is incomplete and should not be described as definitive proof that every design choice was free of influence.

INNOVOX analysis: the episode offers a stronger example of AI-assisted discovery than a benchmark score because the output is public and falsifiable. The model combined software archaeology, pattern recognition, brute-force checking and lattice mathematics, then produced a recipe that runs against a fixed 2000 document. That does not eliminate the need for expert review; it gives experts something concrete to review. For high-stakes technical work, reproducibility is the bridge between an impressive model transcript and reliable knowledge.

What to watch next is whether independent cryptographers confirm the interpretation rather than only the numerical matches. Reviewers may test alternative generation histories, examine the skipped candidates and try to recover the remaining seeds and base points. The other test is methodological: future AI research claims should ship with code, original-source comparisons and clearly stated unknowns. Here, the discovery’s value rests less on how quickly Claude found it than on how easily the core evidence can now be checked.

INNOVOX analysis

The durable contribution is not that an AI model produced a surprising answer, but that it produced a compact, falsifiable recipe that others can rerun against the original standard. This is a useful test for AI-assisted mathematics and security research: novelty becomes credible only when the model’s path ends in independently checkable computation.

What to watch

Watch for review by cryptographers and standards specialists, an explanation for the remaining B-163 seed, and provenance for the base points of P-224, P-256, P-384 and P-521. Also watch whether research labs disclose enough model prompts, code and failed approaches for future AI-assisted discoveries to be audited.