Claude cracks the 25-year mystery behind the internet's favorite crypto curves

Most of the time, when your browser shows a padlock, math is checking that the website is who it says it is. A big share of that math is ECDSA, the most widely used elliptic curve signature standard.

NIST, the US standards agency, adopted ECDSA in 2000 as part of the FIPS 186-2 Digital Signature Standard. That document lists a set of standard curves of different sizes and strengths. The famous ones are P-192, P-224, P-256, P-384 and P-521.

According to cryptographer Filippo Valsorda, P-256 and P-384 are the big ones. They sit in the US government's Commercial National Security Algorithm Suite, and they are the curves behind the ECDSA certificates that secure much of the web.

Each curve was built from a "seed": a 20-byte number that gets hashed to set one of the curve's parameters. The idea is that the curve was picked "verifiably at random," so nobody could secretly choose a weak one.

The catch: the NSA provided the seeds with no explanation. Here's the P-256 one, just sitting in the standard:

• P-256 seed: C49D3608 86E70493 6A6678E1 139D26B7 819F7E90

If you control the starting number, the worry goes, maybe you can steer the curve. That suspicion lived on for decades. Mathematicians Neal Koblitz and Alfred Menezes wrote a well-known paper on it, "A Riddle Wrapped in an Enigma."

The best story came from NSA mathematician Jerry Solinas, who generated the seeds in 1997. He recalled hashing a humorous phrase, "along the lines of 'Give Bob and Jerry a raise' or 'Bob and Jerry rule'." His colleague Bob Reiter wrote the code, and neither remembered the details.

Solinas died in 2023. In response, Valsorda organized a bounty of $12,288 for whoever found the inputs, tripled to $36,864 if the winner gave it to charity. Password crackers went hunting for the phrase. Several Anthropic employees tried too.

Nobody found it. And now we know why: the phrase theory was wrong.

In October 2026, an Anthropic employee asked an internal research model whether it could figure out how the seeds were made. This time, nobody pointed it at the passphrase clue.

In under half an hour, Claude found that none of the five NIST prime-curve seeds came from a hash at all. They were raw output from lrand48, a random number generator that shipped with 1990s C libraries, started from a Unix timestamp.

Think of it like finding out the "secret recipe" was really just whatever the oven timer said when the cook pressed start.

Here's the detective work, step by step:

• The hunch: Claude guessed the 1990s software used a built-in generator. Those old generators are weak enough that their output can be recognized.
• The scan: It wrote a scanner that slid along each seed one bit at a time, testing 34 combinations of generator and output slices.
• The clue: Four of ten seeds had a zero in the top bit of all 20 of their 32-bit words. By chance, that happens with probability 1 in 5,810. That pattern points to lrand48, which only returns the top 31 bits of its 48-bit state.
• The unlock: For the prime curves, recovering the hidden state was a textbook lattice problem, solved with the LLL algorithm.
• The rewind: lrand48 runs backward as easily as forward. Claude stepped each state back to its starting point and found timestamps between May 1997 and April 1998.

By the numbers: the P-256 seed is candidate 1,842 of a run started on August 16, 1997. Each recovered state regenerates all 160 bits of its seed, which, Anthropic notes, does not happen by chance.

In real life Anthropic published the code. Anyone with Python can feed in a 1997 timestamp and watch the exact P-256 seed from the standard pop out. We tried it, and it matched.

Yes, and Anthropic shared the notes. Claude's internal thinking included this:

"This is astonishing: it solves the 25-year-old mystery. Hmm wait. Let me be skeptical: am I in some sort of simulated/test environment?"

It then checked the math directly and concluded the match could not be a coincidence. That's the healthy kind of suspicion you want from a researcher, human or not.

Claude also found something nobody had explained before: where some of the curves' base points came from. The base point is the fixed starting point every ECDSA public key is built from. For P-192 and five ANSI X9.62 example curves, the base points came from the generator in FreeLIP, Arjen Lenstra's math library, using small seeds like 20000.

Why it matters: this is the part people actually cared about. Anthropic's answer is clear. This is not a cryptographic break, a new attack or a weakness in the curves.

If anything, Anthropic says it makes them more confident. The seeds came from a common generator and a clock, a method anyone can now reproduce. That leaves much less room for anyone to have quietly picked a weak curve.

Valsorda had made a similar point when he launched the bounty. Even with full control over the seed, he wrote, the NSA would have needed to know about a huge class of weak curves that nobody in academia or industry spotted in 25 years.

The catch: a few loose ends remain, and Anthropic lists them openly.

• Skipped curves: Some viable curves were passed over. For P-256, candidate 876 of the same run also gave a usable curve. Anthropic says the number of skips is too small for weakened curves to be plausible.
• Unknown run count: In principle, someone could have searched over many timestamps. Nothing in the numbers shows how many runs there were.
• B-163: The seed of this binary curve fits nothing Claude tried.
• Base points: The base points for P-224, P-256, P-384, P-521 and the NIST binary curves are still unexplained.

The $36,864 will be donated to the Internet Security Research Group. Anthropic credits a team of ten people for the work, including John Wood, Henry de Valence, Nicholas Carlini and Steve Weis, whose research inspired the original bounty.

The company also paid tribute to Jerry Solinas, who, it says, took being called an "evil Internet meme" with good humor.

It fits a pattern: Anthropic has been sharing more security research lately, like its test of AI worms on smart TV boxes. More on the company at our Anthropic page.

• No action needed: Your browser and the websites you visit keep using these curves exactly as before. Anthropic says there is nothing to do differently.
• Less to worry about: One of the longest-running "what if the NSA rigged it" theories in security just got a lot weaker.
• AI as a research partner: A model solved, in under 30 minutes, a puzzle that human experts and password crackers had chased for years.