The Numbers Behind Internet Security Were Random Timestamps From 1997. Claude Found Out in 30 Minutes.

Anthropic said on October 16, 2026 that one of its Claude models worked out where the "seed" numbers behind NIST's elliptic curves came from, a question that had sat open for about 25 years 1. The answer: the seeds are output from a random-number generator that shipped with 1990s C libraries, started from a Unix timestamp. Anthropic says the model did it in under half an hour 1.

ECDSA is the most widely used elliptic curve cryptography standard. NIST adopted it in 2000 as part of FIPS 186-2, which lists standard curves of several sizes. For each curve the standard publishes a "seed" parameter whose hash value defines a coefficient of the curve, and the NSA supplied those seeds with no explanation or justification 1. The P-256 seed, as printed, is C49D3608 86E70493 6A6678E1 139D26B7 819F7E90 1.

Unexplained parameters invite one reading: that somebody chose them on purpose. Neal Koblitz and Alfred Menezes wrote a paper on the controversy, and the mystery drew an amateur investigation and a public bounty. The best-known story was that Jerry Solinas, a longtime NSA employee, generated the seeds by hashing a humorous passphrase; in 2015 he said the message was along the lines of "Give Bob and Jerry a raise", and that Bob Reiter wrote the code. Solinas died in 2023, and Anthropic says colleagues from that time were not responsive 1. Filippo Valsorda, who organized the bounty, writes that Daniel Bernstein and Tanja Lange had described a technique that could have used 70 bits of freedom in choosing a seed to aim at a hypothetical class of weak curves, which is part of why the suspicion lasted 2.

An Anthropic employee asked an internal research model whether it could figure out how the seeds were generated, without pointing at the rumored passphrase. In under half an hour the model found the origins of the P-192, P-224, P-256, P-384 and P-521 seeds. None came from a hash algorithm; they are output of lrand48, seeded with a Unix timestamp. Candidate seeds are drawn 20 bytes at a time, and P-256's published seed was candidate 1,842 of its run 1.

The tell was statistical. Sliding a scanner along each seed one bit at a time, across 34 combinations of generator and output slice, the model noticed that in four of the ten seeds the top bit of all 20 words is zero, which happens by chance about once in 5,810. That is the signature of lrand48, which returns the top 31 bits of a 48-bit state. Recovering the state meant trying all 2^17 values of the hidden bits, and the truncated prime-curve seeds gave up their state to LLL lattice reduction 1.

Stepped backwards to its start, each state read as a Unix timestamp: the ten prime-curve runs start between May 1997 and April 1998. Valsorda reimplemented the algorithm in Go to check the claim, and his printout names the timestamp behind each published curve 2.

Anthropic's own reading is that this is not a break or a weakness, and that it makes a deliberately weak choice much less plausible, because the method is simple enough that anyone can reproduce it 1. Valsorda puts a number on the freedom that remained: even choosing freely among 1997–98 timestamps and the first 16 prime-order candidates leaves barely 30 bits, not enough to target a hypothetical weak class and not enough to embed a NOBUS backdoor. He writes that this completes the curves' rehabilitation and that he would now recommend them over Curve25519 — just in time for them to be retired in favor of post-quantum signatures 2.

Some things are still unexplained. The fifth binary-field seed, B-163, fits nothing the model tried. The base points of P-224, P-256, P-384 and P-521 came from a different route that has not been recovered. And some viable candidate seeds were skipped for reasons Anthropic does not know; P-256's run also produced a viable curve at candidate 876 1. The team claimed the bounty on October 15, 2026 at 01:07:51 UTC and donated the $36,864 to the Internet Security Research Group, the non-profit that operates Let's Encrypt 2.

"Nothing Up My Sleeve" is an original rap song and music video built from those two accounts — dark drift phonk, one song, one day's news.