Claude reveals ECDSA curve origins
An AI model reverse-engineered a 25-year-old cryptographic mystery, tracing NIST's secret ECDSA seeds to a 1990s clock-seeded RNG.
Anthropic reports that an internal Claude research model solved a long-standing open question in cryptography: the origin of the mysterious seed values NIST used to generate ECDSA elliptic curve parameters in 2000. Using pattern recognition and lattice reduction (LLL), Claude determined the seeds came from a 1990s C library PRNG (lrand48) initialized with Unix timestamps from 1997-98, rather than a hashed passphrase as previously rumored, and also traced some curve base points to a separate RNG used in Arjen Lenstra's FreeLIP library.
Why it matters
The finding resolves two decades of community suspicion that NSA-chosen ECDSA curve seeds could have hidden a backdoor, since a clock-seeded PRNG is far less suspicious than an unexplained hash. It is also a notable demonstration of an LLM independently applying cryptanalytic techniques (bit-pattern recognition, lattice reduction) to solve a research-grade problem that had defeated human investigators for 25 years.
What is verified
An Anthropic internal research model (Claude) was asked to determine how the NIST ECDSA curve seeds were generated, without being given the prior clue about a humorous passphrase. [1]
Claude determined that the NIST P-192, P-224, P-256, P-384 and P-521 seeds were generated using the lrand48 pseudorandom number generator seeded with a Unix timestamp, rather than from a hash of a passphrase as previously rumored. [1]
Claude used pattern recognition of top-bit structure and Lenstra–Lenstra–Lovász (LLL) lattice basis reduction to recover the internal PRNG state from the published seed values. [1]
The recovered timestamps for the ten prime-curve seeds fall between May 1997 and April 1998, and the four binary-curve seeds read as February 1984 but map to April 1998 if the clock value was doubled. [1]
Claude also traced the base points of six curves (P-192 and five ANSI X9.62 example curves) to specific small-integer seeds in the FreeLIP random number generator used by Arjen Lenstra's long-integer arithmetic package. [1]
Anthropic states this does not constitute a cryptographic break or new weakness, but increases confidence that the NIST curve parameters were not deliberately backdoored. [1]
Open questions remain, including the unexplained origin of the base points for P-224, P-256, P-384 and P-521, and an unresolved seed for the B-163 binary curve. [1]
What is not
- This is a single vendor (Anthropic) self-published account with no independent third-party cryptographic review or replication cited.
- The exact internal research model, its capabilities, and whether a human provided intermediate hints beyond what's described are not fully specified.
- No information on how much manual guidance or iteration by Anthropic researchers was involved beyond the initial framing of the question.
- The claim of 'no backdoor' is an inference from the simplicity of the generation method, not a formal cryptographic proof of curve security.
- The text contains what reads like an internal chain-of-thought transcript from the model; this is reported by Anthropic itself and should be read as their characterization rather than independently verified reasoning.
The case for
Anthropic's account includes technical specifics (seed recovery via LLL lattice reduction, recovered timestamps, generator seeds for base points) that would be hard to fabricate convincingly and are checkable by independent cryptographers, lending credibility to the claim as a genuine research result.
The case against
This is a self-published vendor account of their own model's capabilities with no independent verification included in the evidence, and the described internal chain-of-thought is Anthropic's own framing; the "backdoor-free" conclusion is an inference, not a formal proof, and several parts of the puzzle (B-163 seed, several base points) remain unsolved.
What to do with this
Treat this as an interesting research report rather than an actionable security finding. ECDSA/NIST curve usage requires no changes as a result of this disclosure.
Sources
- 1Anthropic Newsanthropic.com · Primary source
Original source published 16 October 2026 at 19:02.
An AI-assisted briefing by Coding Partners. We link the evidence behind the reporting so you can explore the original work and assess the claims. How CP Signal works.