Claude traces the mysterious NIST curve seeds to a 1990s random generator

For about 25 years, no one could explain where the random-looking seed values in several NIST elliptic curves came from, and the gap fed a long-running suspicion that the curves might hide a backdoor. Anthropic says Claude has now worked out the answer. The seeds for the P-192, P-224, P-256, P-384, and P-521 curves were not hash outputs, as one popular rumor held. They were produced by lrand48, a weak pseudorandom number generator common in 1990s C libraries, seeded with a Unix timestamp that maps to dates in 1997 and 1998.

The method is the interesting part. Claude guessed that the original software used a weak PRNG and looked for seeds whose top bits were all zero, a signature of lrand48, which returns only the top 31 bits of its 48-bit state. For four seeds it recovered the missing bits by brute force. For the prime-curve seeds, which expose fewer bits, it used lattice reduction with the LLL algorithm to recover the generator's internal state, then stepped that state backward to the original timestamp. Anthropic published code that regenerates the seeds so anyone can check.

This is not a weakness in ECDSA or a cryptographic break. The point, Anthropic writes in its report, is that an ordinary clock-seeded generator leaves little room for a hidden backdoor in these parameters. A few items are still open, including the B-163 seed and some base points. The $36,864 bounty for the result goes to the Internet Security Research Group.

Why it matters

Doubt about whether the NIST curves were rigged has shadowed them for two decades and pushed some engineers toward alternatives. This evidence makes the backdoor theory much harder to sustain, and it is a concrete example of a model doing real cryptographic detective work, not just generating plausible text.