Claude traces the origin of the NIST elliptic curve seeds

On 16 October 2026 Anthropic published research on where the seed values behind the NIST elliptic curves come from. The curves are part of ECDSA, which NIST adopted in 2000 in the FIPS 186-2 signature standard. The seeds were supplied by the NSA without any explanation, which led to years of suspicion about hidden weaknesses and to a public bounty for anyone who could account for them. A popular story said they were hashes of a joke phrase.

An Anthropic employee asked an internal research model to work out how the seeds were produced, without pointing it to that rumour. In under half an hour Claude showed that the seeds for P-192, P-224, P-256, P-384 and P-521 were not hash outputs. They came from the lrand48 pseudorandom generator in the C library, started from Unix timestamps that, for the prime curves, fall between May 1997 and April 1998. Claude also explained the base points of six curves from May 1997, which came from the generator in the FreeLIP arithmetic package.

Anthropic stresses that this is not a break, a new attack or a weakness. It says the finding makes a deliberate backdoor much less plausible, because anyone can now reproduce the seeds, and that no action is needed.

Some questions stay open: the B-163 seed and the base points of P-224, P-256, P-384 and P-521 remain unexplained. The $36,864 bounty will go to the Internet Security Research Group.