Anthropic's Frontier Red Team has published a write-up on one of cryptography's longest-running mysteries: where the "seed" values behind the NIST elliptic curves came from. These seeds were handed to NIST by the NSA with no explanation, and they define curves like P-256 that ECDSA (the most widely used elliptic curve signature standard) relies on. For years, people wondered whether that missing explanation hid a backdoor.
The popular theory was that the seeds were hashes of a joke phrase, something like "Give Bob and Jerry a raise". Anthropic says several employees had chased that lead without success. Then, in October 2026, someone asked an internal research model to figure out how the seeds were generated, without giving it the clue. According to Anthropic, in under half an hour Claude showed the seeds were never hashes at all. They came from lrand48, an old C library random number generator, seeded with Unix timestamps between May 1997 and April 1998. P-256, for example, is the 1,842nd candidate from a run started on 16 August 1997.
Claude also explained the base points for six curves, including P-192, which came from the random generator in Arjen Lenstra's FreeLIP library. Anthropic published Python code that regenerates the seeds and those base points. Some things are still unexplained: the B-163 seed, the base points for P-224, P-256, P-384 and P-521, and why a few viable candidate curves were skipped. The $36,864 bounty for finding the seeds is going to the Internet Security Research Group.
My take
First, the practical part, because Anthropic says it clearly and I agree: there is nothing for you to change. If your app signs JWTs with ES256 or your passkey setup uses P-256, carry on. This is not a break. If anything, finding that the seeds came from a boring, reproducible process makes a deliberate backdoor less plausible, not more.
The part I find genuinely interesting is how it was found. Humans had been searching for a phrase because that's what the rumour said. The model instead reasoned about what 1990s software would likely have done, wrote a scanner, spotted that the top bits of some seeds were all zero, recognised that as an lrand48 signature, and then used a lattice technique (LLL) to recover the generator's hidden state. That's not magic. It's the kind of methodical "what would the code have looked like?" thinking good engineers do, just done fast and without getting anchored on a bad tip.
I'd keep a little scepticism in the mix. This was an internal research model, not something you or I can open up today, and "under half an hour" is Anthropic's own account. What makes me trust the result is not the AI story but the code: each recovered state regenerates the full 160-bit seed, and anyone can run the script and check. Reproducibility is doing the heavy lifting here, and it's the bar I'd hold every "AI discovered X" claim to.
My suggestion if you're curious: read the open questions section, not just the headline. The skipped candidate curves and the unexplained base points are where the real remaining discussion is, and Anthropic is honest that it doesn't have answers there yet.
Sources
This post was written with AI assistance from the sources above.
Comments
What do you think? Drop your thoughts below.
Loading comments…