Claude Traced the Origins of Five NIST Curve “Seeds” in Under 30 Minutes

October 17 — Anthropic published a blog post yesterday (16 October) announcing that its internal research model Claude took less than 30 minutes to trace the origins of the “seeds” of five NIST standard elliptic curves, providing a reproducible answer to a cryptography mystery about 26 years old.

Note: a seed here can be understood as a piece of starting data used when generating elliptic curve parameters. The generation rule is like a machine running a fixed program, and the seed is the raw material fed into it. The same raw material processed by the same rules produces the same result. Once a seed is published, others can recompute it and check whether the curve parameters really were generated by the steps described.

The puzzle stems from a set of elliptic curves added to the US digital signature standard in 2000. The seeds were supplied by the National Security Agency (NSA) without any explanation of how they were generated, which long fuelled speculation that a backdoor might be hidden in them. The curves are used in the Elliptic Curve Digital Signature Algorithm (ECDSA), which helps verify the authenticity of digital information.

According to Anthropic, Claude looked instead at software tools that were common in the 1990s and found that the seeds actually came from lrand48, a pseudorandom number generator in a C library, initialised with Unix timestamps.

By identifying bit patterns, recovering the generator’s state and working backwards, the model traced the generation times to 1997–1998. The standard seed for P-256, for example, corresponds to the 1,842nd candidate value in one run. The team has published code so that the results can be reproduced.

The results show that the seeds for P-192, P-224, P-256, P-384 and P-521 can all be generated from Unix timestamps initialised between 1997 and 1998. The P-256 seed corresponds to 16 August 1997, reached after 1,842 rounds of candidate generation.

Anthropic stresses that this is not a break of ECDSA and that no new attack has been found; the result reduces doubts that a backdoor was deliberately inserted into the parameters, and users need not take any action because of it. The research has not explained every detail, however, including where the B-163 seed came from, how the base points of some curves were generated, and why certain available candidate curves were skipped.