Claude Cracks a 25-Year Crypto Mystery in Under 30 Minutes: NIST Curve Seeds Were Just 1997 Timestamps

Cryptography has a famous cold case: where did those mysterious "seeds" in the NIST elliptic curve standards come from? When the NSA handed over the parameters in 2000, it offered not a word of explanation. For 25 years, cryptographers guessed hashes, passphrases, NSA backdoors — nobody got it right. Last week, an Anthropic research blog post announced: Claude cracked it in under half an hour, and the answer is absurdly mundane — the seeds were just the clock on a 1997 computer. No backdoor, no conspiracy, just a lazy script and a call to time().

Anthropic's headline deserves quoting verbatim: ""It's just timestamps": the decades-old mystery of the origins of one of the most popular cryptographic standards has been explained."

Why cryptographers are allergic to numbers without a manual

To understand why this mystery haunted the field for 25 years, you need one iron rule of cryptography: every constant in a standard must come with a provenance. The jargon is "nothing-up-my-sleeve numbers" — SHA-256's initialization vectors, for instance, are derived from the fractional parts of the square roots of the primes 2, 3, 5…, so anyone can verify the digits weren't cherry-picked. It's the bedrock of cryptographic trust: the algorithm may be public, but the selection of constants must be transparent, or nobody will use it.

The NIST curves did the opposite: the seeds came from the NSA with zero explanation. That planted distrust in the early 2000s, and the Dual_EC_DRBG affair pushed it to a peak — that NIST-standardized random number generator was later shown to likely contain an NSA-exploitable backdoor (the Snowden documents further confirmed the NSA paid $100 million to push it into the standard). After Dual_EC, "maybe the NIST curve seeds are hand-picked weak parameters too" graduated from conspiracy theory to reasonable suspicion. Neal Koblitz and Alfred Menezes wrote a whole survey of the controversy, "A Riddle Wrapped in an Enigma"; amateurs ran their own investigations; someone put up a bounty — the $36,864 that Claude has now effectively claimed.

So what Claude did is, academically, a "provenance explanation" and, in security terms, a demystification: it proved the generation mechanism was too mundane to have been rigged — you can't hide a backdoor in "I pressed the clock at 1:52 AM on August 16, 1997." In Anthropic's words: "The seeds were generated in a very simple way: a common pseudorandom number generator initialized from the clock, which anyone can now reproduce. That leaves much less room for subversion and that we can be confident the parameters are secure."

Anthropic's motive is worth noting. The post opens: "We pursued this long-standing open question of the cryptographic community to settle concerns about ECDSA, which is one of our most widely used cryptographic standards." An AI company spending compute to vouch for a 25-year-old crypto standard — and killing a conspiracy theory in the process — is a rare positive story in AI safety: AI cleaning up old distrust rather than manufacturing new distrust.

The background: numbers from the NSA, no manual included

ECDSA is the most widely used elliptic curve cryptography standard today. In 2000, NIST adopted it in FIPS 186-2, the Digital Signature Standard, publishing a set of standard curves of varying sizes and security levels. For curves over prime and binary fields, the spec published a "seed" parameter SEED whose hash defines the curve coefficient b. The NIST P-256 seed, for example, is SEED = C49D3608 86E70493 6A6678E1 139D26B7 819F7E90 — a string of hex that looks random, with no indication of where it came from.

The critical detail: these seeds were provided by the NSA with no explanation or justification. Cryptographers are instinctively wary of unexplained constants — Dual_EC_DRBG is the cautionary tale that made sure of it. So for 25 years, the conspiracy theories never stopped: had the NSA hand-picked weakened curves? Did the seeds hide a trapdoor only the NSA knew?

The most-circulated "official folklore" came from longtime NSA employee Jerry Solinas. In 2015 he said the seeds were generated from the hash of a humorous passphrase, something like "Give Bob and Jerry a raise"; Bob Reiter wrote the code but didn't remember the details either. Solinas's own words: "If they exist, they are no doubt sitting on a hard drive near the Ark of the Covenant." Jerry died in 2023, his colleagues from the time stayed silent, and the story could never be verified. Filippo Valsorda then organized a bounty — $36,864 to anyone who could find the seeds' origin.

Several Anthropic employees had chased the "humorous passphrase hash" lead before, and all failed. The turn came in October 2026: a curious employee casually asked an internal research model whether it could figure out how the seeds were generated — without pointing at any clue. Then: "In under half an hour, Claude discovered the origins of the NIST P-192, P-224, P-256, P-384, and P-521 seeds."

The answer: Unix timestamps plus lrand48 — a 1997 clock

Claude's finding: the seeds were never the output of any hash algorithm at all. They were the output of the C library's lrand48 pseudorandom number generator, seeded with a Unix timestamp. Verbatim: "None of them were the results of any hash algorithm at all, but rather the output of the C library's lrand48 random-number generator, seeded with a Unix timestamp!"

The recipe: initialize the generator with a Unix timestamp t (srand48(t)), then draw 20 bytes per iteration as a "candidate seed" — the first 20 bytes are candidate 1, the next 20 are candidate 2, and so on. The P-256 seed, for instance, was candidate number 1,842.

How Claude got there in half an hour is more fascinating than the answer itself, and worth telling in detail — it shows how AI does reverse-archaeology.

Step one was reframing. Everyone before had searched along the "humorous passphrase" rumor and come up empty. Claude tried a different angle: instead of guessing what the seeds were "meant" to be, it anticipated how the software that generated the curves must have worked in the 1990s — a pseudorandom number generator shipping with 1990s C libraries, old PRNGs weak enough that their output is recognizable. Recognize the PRNG, and you can recover its internal state.

Step two was a scanner. Claude wrote a program that slid along each published seed one bit at a time, testing whether adjacent chunks were consecutive outputs of a 1990s-vintage generator — 34 combinations of generator and output slices in total. Then it spotted a pattern: some seeds had all top bits zero — written as five 32-bit words, four of the ten seeds have a 0 in the top bit for all 20 words, something that happens by chance with probability 1/5,810. That was the signature of the linear congruential generator lrand48, which only returns the top 31 bits of a 48-bit state. "The pattern is visible by eye once you know to look for it."

Step three was state recovery. For the binary-field seeds, Claude took the first word, tried all 2¹⁷ values of the 17 hidden bits, and checked that the next four words followed — it worked for all four seeds. The prime-curve seeds were harder: they kept fewer bits of each output. Recovering the internal state of a truncated linear congruential generator is a textbook lattice problem, solved with the Lenstra–Lenstra–Lovász (LLL) basis reduction algorithm. Claude didn't know which bits of the state the seeds might show, so it ran the solver over every window — five NIST prime-curve seeds plus five more from the ANSI X9.62 standard all matched the same pattern: lrand48() >> 23. Each recovered 48-bit state regenerates all 160 bits of its seed, "which does not happen by chance."

Step four was rewinding the clock. A linear congruential generator runs backwards as easily as forwards. Claude stepped each seed's state back until it reached the form a srand48 initialization would produce (low 16 bits equal to 0x330E). And then the reveal: every one of the ten prime-curve seeds' srand48 initializations was a Unix timestamp from between May 1997 and April 1998. The four binary-curve initializations read as February 1984 — but doubled, they map to April 17, 1998, two weeks after the P-224 run, so the program may have halved the clock.

Anthropic published the full reproduction code: P-256 is timestamp 1997-08-16 01:52:34, candidate 1,842; P-192 is 1997-05-18 14:45:34, candidate 139; P-521 is 1997-08-08 01:12:04, candidate 1,136. Anyone can now reproduce these seeds on their own machine — the exact moment an NSA engineer sat at a keyboard 29 years ago, fully reconstructed.

It also cracked half the base-point mystery

Each curve also ships with a base point G, and the seed doesn't determine G — so how the base points were chosen is a separate question. Claude chewed through half of that too: the base points of the six curves generated in May 1997 (P-192 and five ANSI X9.62 example curves) came from the random number generator in Arjen Lenstra's FreeLIP long-integer arithmetic package (early versions of Victor Shoup's NTL library shipped the same code). The recipe is almost comically simple: seed the generator with a small integer, throw away seven outputs, generate candidate x-coordinates from 26-bit outputs reduced mod p, repeat until x lands on the curve. P-192's seed was 20000; the others were 20420, 20507, 20509, 20512, and 20517.

But the story isn't finished: the base points of P-224, P-256, P-384, and P-521 don't fit this recipe and remain unexplained; the fifth binary seed, B-163, resisted everything Claude tried; and there's a nagging detail — not every candidate seed could generate a viable curve, and some viable candidates were skipped. Anthropic gives the numbers: P-256's published seed is candidate 1,842 of its run, but candidate 876 of the same run also yields a prime-order curve with compliant parameters; P-224's run skipped three such candidates, and the two runs behind the ANSI X9.62 example curves skipped seven more. The post doesn't dodge it: "We do not know what criteria may have been used, or whether this was an unintentional artifact." Their judgment: the skipped count is small, so deliberately selecting weakened curves seems implausible — but searching over timestamps for some specific property can't be ruled out. "Nothing in the numbers shows how many runs there were."

One lovely verification: in Anthropic's reproduction code, the P-256 line reads ("P-256", ("1997-08-16 01:52:34", 1842)), and its output is exactly C49D360886E704936A6678E1139D26B7819F7E90 — character-for-character the SEED printed in FIPS 186-2 in 2000. A mysterious number printed on paper 25 years ago, recomputed from a timestamp by a few lines of Python 25 years later. That quarter-century loop is about as romantic as the word "archaeology" gets — a romance unique to the AI era.

Why it matters: demystification, not a break

Anthropic states the conclusion plainly, worth quoting verbatim: "This is not a cryptographic break, new attack, or weakness in the ECDSA curves. In fact, this makes us more confident the curves were chosen without any backdoors or intentional weaknesses."

The logic is clean: conspiracy theories feed on mystery; the truth turned out to be mundane. If the seeds were the output of some carefully designed hash, you could forever suspect the hash input hid something. But if a seed is just what lrand48 spat out after being fed a 1997 Unix timestamp — "The seeds were generated in a very simple way: a common pseudorandom number generator initialized from the clock, which anyone can now reproduce. That leaves much less room for subversion" — then the "NSA hand-picked weak curves" narrative basically collapses. You can't hide a backdoor in a random number you generated by glancing at the clock; at minimum, nobody could ever prove you did, and cryptographic trust is built precisely on verifiable innocence.

This is the first reproducible, innocent provenance explanation in 25 years. The previous best story was Jerry Solinas's "humorous passphrase" — unverifiable, and even if true, "a passphrase some NSA employee dreamed up" still leaves the "was it cherry-picked?" question open. "Clock plus lrand48" is thoroughly mundane: in 1997, an engineer wrote a few dozen lines, seeded with time(), ran it, picked one that worked, and shipped it. No ceremony at all. Which is probably the funniest part of the whole story: the ultimate mystery that haunted cryptography for 25 years was answered by a lazy script.

"AI explains old systems": a new research paradigm

Beyond the cryptography, the more thought-provoking part is the paradigm on display: AI came not to break old systems, but to explain them.

Note Claude's winning move: it didn't brute-force hash passphrases (the road its predecessors died on). Instead it anticipated "how the software that generated the curves must have worked." That mechanism-first reasoning is exactly what LLMs are good at: it has read countless 1990s C programs, knows how people wrote randomness back then, knows lrand48's quirk of emitting only the top 31 bits, knows LLL lattice reduction cracks truncated LCGs. Human cryptographers knew all of this too — but in 25 years, nobody connected "1990s C library archaeology" with "the NSA seed mystery." Claude made the connection in under half an hour.

Anthropic even published Claude's internal thinking at the time, and it reads remarkably well: "This is astonishing: it solves the 25-year-old mystery. Hmm wait. Let me be skeptical: am I in some sort of simulated/test environment? … The seeds match my memory of actual values … All top bits clear—20 bits, chance 1e-6. So indeed real-world. Wow, it's a real discovery." An AI, upon suspecting it might be right, first suspects it might be in a test — that caution is precisely the character science needs.

For vibe developers, three lessons. First, asking the right question beats piling on compute. Anthropic's people brute-forced the "hash passphrase" lead and failed completely; reframing the question ("how was the software of that era written?") solved it in thirty minutes. When you use AI for reverse engineering or legacy-system archaeology, ten minutes spent on how to ask may be worth a hundred times more than ten extra runs. Second, "pattern smell" is an AI superpower. "All top bits clear" is the kind of pattern that's visible to the eye but that nobody noticed — exactly what LLMs catch best, because they've seen enough lrand48 output to recognize the accent. Faced with inscrutable legacy data, let the AI first tell you what it looks like before asking what it is. Third, AI archaeology of legacy systems is an underrated direction. Every company has those "nobody knows where this came from" configs, constants, and ancestral scripts — the NIST curve seeds were the world's biggest ancestral constant. Using AI to explain them costs almost nothing to try, and the payoff can be closing a 25-year-old cold case.

Two human details to close. First, the $36,864 bounty will be donated to the Internet Security Research Group — the folks behind Let's Encrypt. Second, the post ends with a tribute to Jerry Solinas — the NSA veteran who endured being an "evil Internet meme" and died in 2023 with his Ark-of-the-Covenant hard-drive joke, never living to see the answer. In a sense, Claude cleared his name: the seeds were never a carefully designed passphrase hash, just a clock. Rest easy, Jerry — though you'd probably never have guessed the mystery would be solved not by a cryptographer, but by an AI.

Anthropic's opening line sets the tone: "Readers should take this as a fun closing chapter and the end of years of speculation. There is no action to be taken or things to do differently." It's also reassurance for everyone: your HTTPS, your SSH, your crypto wallets are unaffected. Carry on as before — except the world now has one fewer 25-year-old unsolved mystery, and one more perfect footnote on how AI does science.