Claude & Cryptography: 25-Year NIST ECDSA Seed Mystery Solved

For over a quarter-century, cryptographers have debated the provenance of the five standard NIST elliptic curves (P-192, P-224, P-256, P-384, and P-521) designed by the National Security Agency (NSA) and standardized in FIPS 186-2 in 2000. While the curve equations were verifiably derived via SHA-1 hashing of five 160-bit hexadecimal values known as seeds, the NSA never recorded how those seeds were generated. On October 16, 2026, Anthropic Research revealed that an internal Claude model solved the entire 25-year mystery in under 30 minutes without human intervention.

Zero-Bit Structural Anomalies and 1990s C Library lrand48 Signatures

Tasked with investigating the $36,864 cryptographic bounty organized by Filippo Valsorda, Claude bypassed conventional dictionary-hashing brute force and inspected the raw binary layout of the five 160-bit seed constants.

Claude pinpointed a revealing anomaly in the P-384 seed: four zero bits positioned at indices 31, 79, 127, and 159. Recognising that each index equals a multiple of 48 minus one, the model deduced that 31-bit unsigned integers were being packed into 48-bit words, the exact fingerprint of the standard 1990s Unix C library pseudorandom number generator lrand48() initialized via srand48(time(NULL)).

6-Millisecond LLL Lattice Reduction Recovers 1997-1998 Timestamps

To invert the 48-bit linear congruential generator and test whether the initial states corresponded to Unix epoch timestamps, Claude formulated a lattice basis reduction script using the Lenstra-Lenstra-Lovasz (LLL) algorithm. Executing in 6 milliseconds, the script recovered five valid timestamps falling squarely within US East Coast business hours between May 1997 and April 1998:

Cryptographic Assurance and ISRG Bounty Donation

Because finding a prime-order curve via the Schoof-Elkies-Atkin point-counting algorithm requires testing roughly 1,000 sequential increments per seed, the discovery that each starting seed came directly from the system clock proves the NSA did not grind through millions of candidate seeds to exploit an undisclosed mathematical weakness.

Claude also resolved a secondary mystery: how the base point G on each curve was derived, proving it matches the deterministic output of the vlong_value PRNG inside Arjen Lenstra's 1995 FreeLIP big-integer library. Anthropic is donating the full $36,864 bounty to the Internet Security Research Group (ISRG), the nonprofit behind Let's Encrypt.

“Reconstructing the exact 1997 and 1998 system timestamps closes a 25-year chapter in public-key cryptography, confirming that the curves securing modern TLS and hardware enclaves were generated without hidden seed manipulation.”