Elliptic Curve Cryptography: Claude Cracked the NIST Seeds Mystery

October 16, 2026 — an internal Claude research model solved the 25-year mystery at the heart of elliptic curve cryptography: where the NIST curve seeds came from. The answer wasn't a secret NSA passphrase. It was a clock.

What is the NIST curve seeds mystery?

In 2000, the US government published FIPS 186-2, a federal standard defining the ECDSA elliptic curves that still underpin most of the internet's cryptography: P-192, P-224, P-256, P-384, and P-521. Each curve was derived from a random-looking "seed" via a SHA-1-based process. But the standard never explained where those seeds themselves came from. For 25 years, that silence fueled speculation that the NSA had quietly rigged the constants — the famous "nothing up my sleeve" problem with no sleeve shown.

The reigning theory: a joke that sent everyone hunting

The most popular explanation came from Jerry Solinas, a former NSA mathematician (he died in 2023). In 2015 he recalled that the seeds might be the hash of a humorous phrase — something like "Give Bob and Jerry a raise." Bob Reiter had written the code that generated the seeds; Solinas was the mathematician in the room. For years afterward, researchers burned compute hunting for a phrase whose hash would match a published seed. Nobody found one.

What Claude found in under 30 minutes

An Anthropic employee asked an internal Claude research model to investigate the seeds' origins — deliberately without steering it toward the passphrase rumor. In under 30 minutes, Claude cracked it: the seeds are not hashes at all. They are outputs of the C library's lrand48 pseudorandom number generator (the POSIX drand48 family), seeded with an ordinary Unix timestamp.

The recipe: initialize the generator with timestamp t, run n iterations, each producing 20 bytes as a candidate seed. The standardized P-256 seed — C49D360886E704936A6678E1139D26B7819F7E90 — was candidate #1,842 from a run started August 16, 1997, 01:52:34 UTC (Unix timestamp 871696354). All ten prime-curve seeds trace to generator runs between May 1997 and April 1998; the binary-curve seeds point to February 1984 or April 1998. Anthropic published reproducible code confirming the matches.

How Claude cracked it: the fingerprint

Claude's key insight was statistical. Four of the ten seeds had all-zero top bits in each 32-bit word — something with roughly 1-in-5,810 odds for genuinely random data. That anomaly was the fingerprint of lrand48. From there, Claude recovered the generator's internal state: the LLL lattice-reduction algorithm for the truncated prime-curve outputs, brute force for the binary-curve seeds — then rewound the clock to find the 1997–1998 timestamps that reproduce every seed. The base points for several curves, it turns out, came from Arjen Lenstra's FreeLIP library via a seed-and-discard recipe from May 1997. A ten-person Anthropic team (John Wood, Henry de Valence, Ava Howell, Zack Voase, Lucy Sweet, Amir Omidi, Paul Crowley, Iain McGinniss, Nicholas Carlini, and Steve Weis) wrote it up; Filippo Valsorda's $36,864 bounty was claimed and donated to the ISRG.

What this does NOT mean — read this first

Anthropic was explicit: "This is not a cryptographic break, new attack, or weakness in the ECDSA curves." No private keys can be derived from this. No signatures can be forged. Nothing needs patching, rotating, or migrating. The finding actually makes deliberate backdoors less plausible: the recipe is mundane, reproducible, and now public. If you were worried the curves were rigged, this is the best news you could get.

What's still unexplained (honestly)

Not everything is solved, and Anthropic said so plainly: one binary-curve seed (B-163) and the base points of P-224, P-256, P-384, and P-521 remain unexplained. The post published those leftovers alongside the answers — which is exactly how this kind of disclosure should work.

Why this matters for elliptic curve cryptography

Two lessons. First: the most mundane explanation won — a 1997 timestamp and a stock C library function beat 25 years of "the NSA hid a backdoor" theorizing. Occam's razor held. Second: an AI did genuine cryptanalytic archaeology in half an hour, a task that consumed years of expert human effort. That is a preview of AI auditing legacy standards for real weaknesses — and when it finds one, we'll want the same honest publication: reproducible code, stated limits, and the leftovers nobody can explain yet.

Test yourself: the 30-minute mystery quiz

Frequently asked questions

What did Claude discover about the NIST elliptic curve seeds?

Claude found that the NIST ECDSA curve seeds are not hashes of secret phrases. They are outputs of the C library's lrand48 pseudorandom number generator, seeded with a Unix timestamp. The P-256 seed, for example, was candidate #1,842 from a generator run started on August 16, 1997.

Does the NIST curve seed discovery mean the curves are broken?

No. Anthropic explicitly stated this is not a cryptographic break, new attack, or weakness in the ECDSA curves. No private keys can be derived, no signatures can be forged, and nothing needs patching. The finding actually makes deliberate backdoors less plausible, because the recipe is mundane and reproducible.

What was the "Give Bob and Jerry a raise" theory?

The reigning theory for years was that the NIST seeds might be hashes of a humorous phrase, possibly "Give Bob and Jerry a raise" — Bob Reiter wrote the generation code and Jerry Solinas was the NSA mathematician who recalled the anecdote. Researchers spent years hunting for a matching hash input. Claude's discovery made that theory unnecessary.

How did Claude figure out the seeds came from lrand48?

Claude spotted a statistical fingerprint: four of the ten seeds had all-zero top bits in each 32-bit word, odds of roughly 1 in 5,810 for true randomness. That pointed to lrand48. It then recovered the generator's internal state with the LLL lattice-reduction algorithm for truncated outputs and brute force for binary-curve seeds, and rewound to matching 1997-1998 clock values.

Is everything about the NIST seeds now explained?

No. The B-163 binary-curve seed and the base points of P-224, P-256, P-384, and P-521 remain unexplained, and Anthropic published those leftovers honestly alongside its reproducible code.

Vibe-Code Audit — Ingenious AI's AI code-audit platform — is built on the same idea this story demonstrates: AI systems that dig into code and standards and report what they find, honestly, with reproducible evidence. Get early access on WhatsApp.