Claude traced the NIST P-256 curve seeds to lrand48 and Unix timestamps: what it means, and how to reproduce it in 20 lines of Python

Anthropic says an internal Claude research model worked out in under half an hour that the seeds behind NIST P-192, P-224, P-256, P-384 and P-521 came from the C library's lrand48 generator seeded with 1997-98 Unix timestamps, not from hashed phrases. Anthropic calls it a closing chapter, not a break. Here is what was found, what is still open, and the public-domain script that regenerates the seeds.

On October 16, 2026, Anthropic’s Frontier Red Team published an answer to one of cryptography’s longest-running small mysteries: where the “seed” values behind the NIST elliptic curves came from. These are the curves in FIPS 186-2, and P-256 and P-384 in particular sit under much of the web’s ECDSA certificates.

Short version for builders: nothing to patch. Anthropic’s own words: “There is no action to be taken or things to do differently.” The finding makes a deliberately planted weakness less plausible, not more.

The mystery

Each NIST prime curve was generated “verifiably at random”: a 160-bit seed is hashed with SHA-1 to derive the curve coefficient b. The seeds came from the NSA with no explanation. The story attributed to longtime NSA employee Jerry Solinas, who died in 2023, was that they were hashes of a joke phrase along the lines of “Give Bob and Jerry a raise”. In 2023 Filippo Valsorda announced a bounty for cracking the five seeds: $12,288, tripled to $36,864 if donated to charity.

What Claude found

Per Anthropic, an employee asked an internal research model to work out how the seeds were generated, without pointing it at the hashed-phrase clue. In under half an hour it concluded:

No hash at all. The P-192, P-224, P-256, P-384 and P-521 seeds are output of the C library’s lrand48 generator, kept as lrand48() >> 23, after srand48 was seeded with a Unix timestamp.
The timestamps fall between May 1997 and April 1998. P-256 is candidate 1842 of a run started at 1997-08-16 01:52:34 UTC, with 20 bytes drawn per candidate.
The method: a scanner checked whether chunks of each seed looked like consecutive output of a 1990s C-library generator. For the prime curves, recovering the hidden 48-bit state from truncated output is a lattice problem, solved with LLL basis reduction. Each recovered state regenerates all 160 bits of its seed, and Anthropic says that cannot happen by chance.
Bonus: six base points (P-192 and five ANSI X9.62 example curves) come from the random number generator in Arjen Lenstra’s FreeLIP library, seeded with small integers such as 20000 for P-192.

Reproduce it yourself

The post includes CC0 (public-domain) Python. The core is a single lrand48 step: x = (0x5DEECE66D * x + 0xB) % 2**48, starting from (t << 16) | 0x330E, which is the state srand48(t) sets. We ran Anthropic’s script with no changes. It printed C49D360886E704936A6678E1139D26B7819F7E90 for P-256, A335926AA319A27A1D00896A6773A4827ACDAC73 for P-384 and BD71344799D5C7FCDC45B59FA3B9AB8F6A948BC5 for P-224, which match the seeds printed in FIPS 186-2 and the values listed on the bounty page.

Still open

For P-256, candidate 876 of the same run also produces a valid prime-order curve, yet 1842 was published. P-224’s run passed over three such curves. Nobody knows the selection rule. Anthropic argues the small number of skips makes a weak-curve search implausible.
The B-163 binary seed is unexplained, and so are the base points of P-224, P-256, P-384 and P-521.
The $36,864 bounty goes to the Internet Security Research Group.

Why it matters

Like Claude Mythos helping break Apple’s M5 kernel or agents finding Redis zero-days, this is a model doing real security research. The difference is that here every claim can be checked on a laptop in seconds. For hardening the agents themselves, see how Anthropic defends its code harness.

Sources: Anthropic: Claude reveals ECDSA curve origins · NIST FIPS 186-2 · Filippo Valsorda: NIST Elliptic Curves Seeds Bounty · lrand48(3) man page