For decades, the cryptographic community has questioned the provenance of the 'seed' parameters used to define the NIST elliptic curve standards, such as the P-256 curve. These seeds are critical components of the Elliptic Curve Digital Signature Algorithm (ECDSA), one of the most prevalent cryptographic standards today. Because the National Security Agency (NSA) provided these seeds without explaining their derivation, researchers long speculated whether the parameters contained intentional backdoors or hidden weaknesses. While some theories suggested the seeds were hashes of humorous passphrases, these leads remained unverified for years.
In October 2026, Anthropic researchers used a Claude model to analyze the seeds from a different perspective: anticipating the specific software environment of the 1990s. The model identified that the seeds were not hashes at all, but rather outputs from `lrand48`, a linear congruential generator commonly found in older C libraries. By recognizing the specific patterns of this weak generator—such as the fact that it only returns the top 31 bits of a 48-bit state—Claude was able to reconstruct the internal state of the generator. The team then used the Lenstra–Lenstra–Lovász (LLL) basis reduction algorithm to solve the resulting lattice problems, successfully recovering the 48-bit states for several NIST prime-curve seeds.
The investigation revealed that these seeds were generated using Unix timestamps from the late 1990s. For example, the P-256 seed was linked to a timestamp from February 1984 (possibly doubled), while others mapped to dates between May 1997 and April 1998. Anthropic notes that this discovery does not constitute a cryptographic break; rather, it provides a degree of assurance that the curves were chosen via a simple, reproducible process rather than a complex, potentially subversive method. However, some questions remain: the model could not recover the seed for the B-163 binary curve, and the specific selection criteria for why certain candidates were chosen over others during the original generation process remain unknown. The researchers have donated the $36,864 bounty for solving the mystery to the Internet Security Research Group (ISRG).