Anthropic says a Claude research model explained where the NIST P-curve seeds came from in under half an hour: 1997–98 Unix timestamps fed to the C library's 48-bit rand48 generator, not a hashed phrase; Filippo Valsorda confirms and pays the bounty
Anthropic published research on 16 October 2026 saying an internal Claude research model worked out, in under half an hour, how the unexplained 'seed' values behind the NIST elliptic curves P-192, P-224, P-256, P-384 and P-521 were produced. The seeds, supplied by the NSA and published in FIPS 186-2 in 2000 without explanation, have long fuelled suspicion that the curves could have been chosen with a hidden weakness. According to Anthropic, they were not hashes of a forgotten phrase, as the long-told story went, but successive 20-byte outputs of the POSIX 48-bit rand48 pseudorandom generator seeded with the then-current Unix time. Each prime-curve run dates to between May 1997 and April 1998; for example P-256 is the 1,842nd candidate from a run seeded at 01:52:34 UTC on 16 August 1997. Claude spotted a statistical fingerprint in the top bits of some seeds, recovered the generator state with LLL lattice reduction, and stepped it back to a timestamp; the same method explained five ANSI X9.62 example-curve seeds and, if the clock was halved, four binary-curve seeds. It also traced the base points of P-192 and five X9.62 curves to the FreeLIP library's generator. Filippo Valsorda, who ran the NIST Elliptic Curves Seeds Bounty, re-implemented the method in Go, confirmed it (he describes the drand48 variant of the same generator family) and says the Anthropic team claimed the bounty on 15 October; the US$36,864 is being donated to ISRG, which runs Let's Encrypt. He argues the finding rules out the 2017 Bernstein–Lange idea of using seed freedom to aim at a hidden class of weak curves, since the generation leaves roughly 30 bits of choice at most. Still unexplained: why some valid candidates were skipped (P-256's own run produced a usable curve at candidate 876), the B-163 seed, and the base points of P-224, P-256, P-384 and P-521. Anthropic and Valsorda both say this is not a break or weakness in the curves and nothing needs to change. Primary: Anthropic (16 Oct); confirmation: Filippo Valsorda (16 Oct).
- Product
- NIST FIPS 186 prime curves P-192, P-224, P-256, P-384, P-521 (ECDSA / ECDH); ANSI X9.62 example curves
- Exploited in Australia?
- unknown
- Patch to
- No action needed: both Anthropic and Valsorda say the curves are not weakened. Teams that avoided P-256 or P-384 over seed-provenance worries can treat that concern as largely resolved; keep normal crypto-agility and post-quantum migration planning in line with ASD's ISM guidance.
Primary: Anthropic — Claude reveals ECDSA curve origins (16 Oct 2026) · Vendor: Filippo Valsorda — The NIST Elliptic Curves Seeds Bounty has been claimed (16 Oct 2026)