Claude cracks 25-year mystery of NIST curve seeds

The origin of the NIST elliptic curve seeds, one of cryptography's longest-running puzzles, has been explained by an AI model. Anthropic said on Oct. 16 that an internal research model took less than half an hour to show that the seeds behind the P-192, P-224, P-256, P-384 and P-521 curves were not hashes of a secret phrase but output from a standard C library random number generator seeded with Unix timestamps.

What happened

NIST made the curves part of its FIPS 186-2 digital signature standard in 2000. The NSA supplied the seeds without explanation, and their provenance became a long-running question, Anthropic said. The popular theory was that NSA mathematician Jerry Solinas had hashed a humorous sentence he later forgot. Solinas died in 2023.

An Anthropic employee asked the model to investigate without pointing it to that theory. Claude matched the published P-256 seed exactly at the 1,842nd candidate in the generated sequence, CoinDesk reported. The timestamps fall in 1997 and 1998, the period when the seeds were handed to the standards authors.

The search for an answer had run for years. In a 2015 paper, cryptographers Neal Koblitz and Alfred Menezes dissected the controversy, and Menezes recalled receiving the seeds from Solinas in 1997. Researcher Steve Weis filed public-records requests in 2018, but NIST said it had no documentation. In 2023, Valsorda and others offered a $12,288 bounty, rising to more than $36,000 if donated.

Cryptographer Filippo Valsorda confirmed the result by reimplementing the method in Go. Ten Anthropic staff claimed his bounty on Oct. 15 and donated it to ISRG, the nonprofit behind Let's Encrypt, which tripled its value to $36,864, he wrote.

Why it matters

The finding matters because the NIST elliptic curve seeds were a focal point of distrust. Once the Snowden leaks tied the NSA to attempts to undermine standards, critics worried the agency had cycled through seeds until it landed on a curve with a flaw known only to itself. A timestamp-driven generator makes that kind of hidden selection much harder to argue.

Anthropic said there is no action for users to take, and most researchers already trusted the curves. Valsorda noted that one undocumented selection criterion remains unexplained, so the history is not fully closed.

Valsorda said the seeds were rejected if the order of the resulting curve had a longer bit length than the curve's base field. Even after that rule, roughly twice as many valid seeds exist as were published, and no theory explains the gap yet, he wrote. One idea is that the same generator was used to validate seeds, skipping some candidates.

For crypto holders, the impact is indirect. Bitcoin uses secp256k1, a different curve with little room to hide a weakness, so it was never exposed to this concern, CoinDesk noted. The live risk for bitcoin keys is quantum computing, the subject of Google's latest Willow results and of Coinbase's post-quantum readiness work.

What's next

The episode is also a marketing win for AI in security research, where labs are competing to show models can do expert-level work. Expect other long-standing cryptographic questions to be thrown at frontier models.

Valsorda said the explanation reinforces confidence in critical primitives. The remaining puzzle in the NIST elliptic curve seeds is narrow, but researchers will keep testing the rejected candidates for patterns.