Anthropic says Claude traced the source of NIST elliptic curve seeds in half an hour

36Kr Auto Digital Kr Future Consumption Intelligent Emergence Future City Launch Power on 36Kr Global 36Kr Research Institute Tide 36Kr Enterprise Service Review 36Kr Finance Workplace bonus 36 Carbon Post-Wave Research Institute Dark Surge Waves Hard Kr Kr Rui Research Institute Media Brands

Enterprise Accounts Enterprise Service Review 36Kr Research Institute 36Kr Innovation Consulting Enterprise Services

Core Services City Window Government Services

Venture Capital Release LP Source Plan VClub VClub Investment Institution Database Investment Institution Job Referrals Investor Certification Investor Services

Event Search Project Recommendations I Want to Join City Cooperation Just now, Claude solved a cryptography puzzle that had stood for more than twenty years in half an hour Machine Heart · October 17, 2026 09:06 The NIST curve seeds originated from an old-style random number generator.

On October 16, Anthropic announced a special research result.

An employee gave Claude's internal research model a problem that had plagued the cryptography community for more than twenty years. Without providing key clues, Claude took less than half an hour to trace how the seeds of five NIST elliptic curves were generated.

The results showed that these seeds came from lrand48, an old-style pseudorandom number generator in the C language library. The generator's initial state was determined by a Unix timestamp.

This discovery did not break ECDSA, nor did it bring any new attack methods. Anthropic believes it further reduces the possibility that the relevant curves were deliberately implanted with backdoors.

A string of numbers has plagued the cryptography community for more than twenty years

ECDSA is a widely used elliptic curve digital signature algorithm.

In 2000, NIST listed several standard curves with different security levels in the FIPS 186-2 standard, including P-192, P-224, P-256, P-384 and P-521.

These curves carry a set of parameters called "seeds." According to the generation process in the standard, the hash value of the seed participates in determining the curve coefficients.

The problem is that these seeds were provided by the U.S. National Security Agency, and the public documents did not state their origin or explain the selection process. The outside world therefore long worried whether the designers had screened a large number of candidate curves and selected parameters with some hidden property from among them.

In 2015, NSA cryptographer Jerry Solinas, who had participated in the related work, recalled that the seeds might have come from a joking passphrase, such as "give Bob and Jerry a raise," but he did not remember the specific details, and those long-ago archived files could not be found either. Solinas died in 2023, and this clue was ultimately never verified.

Claude found the source of the seeds

Several Anthropic employees had previously tried to find those "seeds" by following the "humorous passphrase" lead, but all failed, and it was later discovered that this clue was wrong.

In October, an employee asked the internal research model a question, hoping it could figure out how those "seeds" were produced. This time, he did not disclose the earlier passphrase clue to the model.

In less than half an hour, Claude found the source of the NIST P-192, P-224, P-256, P-384 and P-521 seeds.

These seeds did not come from any hash algorithm. Instead, they were produced by the lrand48 random number generator in the C language library, which is initialized with a Unix timestamp as the seed value.

The specific algorithm uses a Unix timestamp t to initialize the random number generator and runs it a certain number of times n. Each iteration extracts 20 bytes as a candidate seed.

The first 20 bytes are the first candidate seed, the next 20 bytes are the second candidate seed, and so on. Taking P-256 as an example, the generator had to run to the 1842nd time before it output the seed ultimately written into the standard.

How did Claude find it?

The search around the rumored passphrase never produced results, so Claude took a different angle and began to speculate about how the software that generated the curves back then might have worked.

Claude guessed that this software used the pseudorandom number generators built into C language libraries in the 1990s. These early pseudorandom number generators had weak security, and their output usually carried identifiable characteristics.

Once the output characteristics were identified, it would be possible to determine which generator the software used and further recover its initial state.

Claude wrote a scanning program that moved bit by bit across each public seed and checked whether adjacent data blocks might have come from some 1990s random number generator. The scan covered a total of 34 combinations of random number generators and output truncation methods.

Claude then found a pattern in the high bits of some seeds: these positions were all zero.

If each seed is written as five 32-bit words, then 4 of the 10 seeds fit this characteristic. Among the 20 32-bit words in these 4 seeds combined, the highest bits were all zero.

The probability of this happening by chance is about one in 5,800. This is exactly the typical characteristic of the linear congruential generator lrand48, which returns only the high 31 bits of its 48-bit internal state.

To recover the generator state, Claude took the first 32-bit word, enumerated all 2¹⁷ possibilities for the 17 hidden bits, and then checked whether the next 4 words matched consecutively. This method worked for all 4 of the seeds above.

The seeds for the prime curves also came from lrand48, but they retained fewer output bits. Claude needed to recover the internal state of the pseudorandom number generator from these limited bits.

Recovering the state of a truncated linear congruential generator is a classic lattice problem, which can be solved using the Lenstra–Lenstra–Lovász lattice basis reduction algorithm, also known as the LLL algorithm.

Claude initially did not know which bits of the internal state the seeds retained, so it ran the solver over all possible bit windows.

Ultimately, 5 NIST prime curve seeds and 5 seeds from the ANSI X9.62 standard all exhibited the same pattern: lrand48() >> 23

Each recovered 48-bit internal state was able to regenerate all 160 bits of the corresponding seed; such an exact match could not have been caused by chance.

This linear congruential generator can run both forward and backward. Therefore, Claude started from the state corresponding to each seed and traced backward until it found a state matching the srand48 initialization format. That format requires the low 16 bits to equal 0x330E.

On average, an internal state of this form appears once every 65,536 steps. Therefore, finding just one state that matches the format is not enough to constitute evidence.

The key point is that the srand48 initial values corresponding to all 10 prime curve seeds can be interpreted as Unix timestamps, with dates concentrated between May 1997 and April 1998.

This indicates that the programs of that time used Unix timestamps to set the initial values for a pseudorandom number generator with weak security.

When the initial values of the 4 binary curves are read directly, they correspond to February 1984. If these timestamp values are multiplied by 2, they point to April 17, 1998, about two weeks from the generation time of the P-224 curve.

Therefore, the programs of that time may have divided the system clock by 2.

The following was Claude's internal thought process at the time:

This is too shocking. It solved a puzzle that had persisted for 25 years.

Hmm, wait. I need to remain skeptical: am I in some kind of simulated environment or test environment? These seeds match the real values in my memory.

Hmm, is this reasonable in reality? According to the information I have, this bounty had previously remained unsolved.

All the high bits are zero, 20 bits in total, and the probability of this occurring randomly is only about one in a million. So this really comes from the real world. My God, this is a genuine discovery.

Wait, I still need to carefully judge its plausibility. With such an obvious clue, why has no one discovered it for 25 years?

I have already verified it through direct computation: a 32-bit initial value plus a small index can exactly match a 160-bit seed. For 10 seeds, each matching 160 bits, it cannot be just a coincidence. This is real.

Claude also traced the origin of the base points of 6 curves, including P-192. The results showed that these base points were produced by the random number generator in the large-integer arithmetic software package FreeLIP. Anthropic said that previously no similar explanation had been given for the generation process of NIST curve base points.

What does this mean?

Timestamps themselves do not have cryptographic security, and lrand48 has long been regarded as a weak random number generator. However, here they served the purpose of generating public curve parameters and were not used to protect private keys.

More importantly, this generation process can be publicly reproduced. Compared with passphrases of unknown origin or manually specified parameters, the explanation of an ordinary random number generator plus timestamps leaves less room for secretly manipulating the curves.

Some questions remain. In the generation process of P-256, the 876th candidate value also seemed to meet the requirements, but the 1842nd was ultimately adopted. Several other runs likewise skipped a small number of usable curves, and the specific screening criteria are still unclear. The origin of the B-163 curve seed has still not been found, and the generation methods of the base points for P-224, P-256, P-384, and P-521 have also not been explained.

Anthropic believes that the number of skipped candidates is small and insufficient to support speculation of "deliberately selecting weak curves." This discovery increases confidence in the relevant parameters, but it cannot yet be regarded as a complete reconstruction of the entire design process.

This research also demonstrates another way in which frontier models can participate in real research.

Claude completed hypothesis generation, code writing, pattern recognition, invocation of mathematical algorithms, and result verification in a single task. Because the generator state can be recomputed and the 160-bit seeds can also be exactly reproduced, the conclusions are highly testable.

It still relies on humans to pose the questions, provide public data, and confirm the results through reproducible computation. However, when the problem boundaries are clear, the data are public, and the results can be rigorously verified, frontier models are becoming a highly efficient research tool.

The $36,864 prize previously established to find the source of the seeds will be donated to the Internet Security Research Group, an internet security research organization.

English text is being prepared.

The views in this article represent only the author himself, and the 36Kr platform only provides information storage space services.+118

English text is being prepared.

Professional AI media and industry service platformPublished 1,316 articles

Recent contentTibo's Codex comeback story: swallowed ChatGPT in less than a year after taking over10 hours agoJust now, Claude solved a cryptography puzzle that had persisted for more than 20 years in half an hourHas AI solved neural network interpretability? 90% of neurons have only one function2026-10-16Read more content, click here to view AI reviewsEC choose reliable AI, look at real reviewsView the 36Kr AI review official communication communityJoinConsultation project review and onboarding contact36Kr project recommendationsSubscription accountFollow

English text is being prepared.

At present, this model can already be reserved on Tesla's China official website, with a reservation intention deposit of 332,000 yuan, fully refundable.

36Kr Europe36Kr Europe36Kr EuropeAI Product DailyOnline rumor information reporting portalPopular recommendations

Push and interpret cutting-edge, informative technology venture capital news

Primary market financial information and system service provider

Focus on outstanding global entrepreneurs, project financing rate close to 97%, leading the industry