Anthropic reported on Friday that an internal research version of Claude solved one of cryptography's longest-running open questions in under half an hour: the origin of the mysterious "seeds" behind NIST's standard elliptic curves. The answer, published on the company's research blog, is not a hash of a secret passphrase, as decades of speculation suggested, but the output of `lrand48` — the C standard library's pseudorandom number generator — seeded with a Unix timestamp.
The finding closes a question that has shadowed ECDSA, the most widely used elliptic curve cryptography standard, since NIST adopted it in 2000 as part of the FIPS 186-2 Digital Signature Standard. And it lands as another data point in the growing record of AI systems contributing to genuine research: for more coverage of that trend and other breaking AI news, AI Buzz Wire tracks each development as it happens.
A Mystery Hiding in Plain Sight
ECDSA specifies a set of standard elliptic curves of varying sizes and security levels. For curves over prime and binary fields, the specifications include a "seed" parameter whose hash value is used to define the coefficient b of the curve. Those seeds were provided by the NSA with no explanation or justification — a provenance gap that made cryptographers uneasy for over two decades.
The NIST P-256 curve, for example, lists the seed `C49D3608 86E70493 6A6678E1 139D26B7 819F7E90`, with no information about where it came from. Unexplained constants in security-critical standards are not a trivial concern: cryptographers had spent years wondering whether the curves could have been chosen with deliberate weaknesses, a suspicion shaped by the earlier Dual_EC_DRBG episode. Cryptographers Neal Koblitz and Alfred Menezes devoted a paper, "A Riddle Wrapped in an Enigma," to the history and the worries around the seed values, and an amateur investigation later offered a bounty for anyone who could pin down their origin.
The Passphrase Story That Wasn't
The best-known explanation came from Jerry Solinas, the longtime NSA employee behind the seeds. In a 2015 recollection, Solinas said the seeds were generated by hashing a humorous passphrase — something along the lines of "Give Bob and Jerry a raise" or "Bob and Jerry rule." He cautioned that he did not remember the details, that Bob Reiter wrote the code, and that no archives from that era survived. "If they exist, they are no doubt sitting on a hard drive near the Ark of the Covenant," Solinas wrote.
The story was colorful, but unverifiable. Solinas died in 2023, and former colleagues were not responsive, leaving the question open — and leaving the passphrase hunt empty-handed.
Enter Claude
In October 2026, a curious Anthropic employee asked an internal research model whether it could figure out how those seeds were generated — without pointing it at the passphrase clue. According to Anthropic, in under half an hour Claude discovered the origins of the seeds for all five standard curves: P-192, P-224, P-256, P-384 and P-521.
None of them were the output of any hash algorithm. They were the output of `lrand48`, the pseudorandom number generator that shipped with 1990s C libraries, initialized with a Unix timestamp. The generating algorithm sampled bytes from the RNG for some number of iterations, drawing 20 bytes per candidate seed; the first 20 bytes were candidate one, the next 20 candidate two, and so on. Reproducing the official P-256 seed required 1,842 iterations.
How the Model Got There
Earlier searches built around the rumored passphrase had come up empty, and Claude took a different angle: rather than hunting for a phrase, it anticipated how the software that generated the curves must have worked. Anthropic says the model guessed that the 1990s tooling would have used a pseudorandom number generator from the C standard library — generators weak enough that their output can be recognized when you know what to look for. That recognition step turned an intractable search over unknown strings into a tractable search over a small parameter space of timestamps and iteration counts.
What It Means — and What It Doesn't
Anthropic is explicit about the limits: this is not a cryptographic break, a new attack, or a weakness in the ECDSA curves, and there is no action for anyone to take. If anything, the company argues, the finding increases confidence that the curves were chosen without backdoors or intentional weaknesses. A seed generated by a common, reproducible pseudorandom generator initialized from the clock leaves far less room for subversion than an unexplained constant would.
The company framed the result as "a fun closing chapter and the end of years of speculation," noting that most researchers already trusted the curves. That trust now rests on something better than convention: anyone can reproduce the seed generation from a Unix timestamp and verify it against the published constants.
Another Notch for AI-Assisted Research
Whatever else it is, the episode is a striking demonstration of a research tool doing what human teams could not: retrieving a solution that depended on reconstructing the mindset of 1990s systems programming, testing it against hard cryptographic constants, and settling a question that outlived the people who could have answered it from memory. The bounty hunters who chased a passphrase for years were looking for poetry. The answer, it turns out, was bookkeeping.
---
Stay Ahead of AIGet the latest AI news, analysis, and breakthroughs — all in one place.
Read more AI news →
