Claude Cracks 25-Year Cryptography Mystery in Half an Hour: NIST Curve Seeds Came From a 1997 Clock

What happened

In its October 16 research report, Anthropic wrote that an employee asked an internal research model to work out how the seeds were generated, deliberately withholding the long-circulating "humorous phrase" rumor. Claude found the answer in under half an hour: it spotted a statistical fingerprint of the old generator in the seed bits, recovered the generator's hidden internal state with lattice (LLL) techniques, then ran the generator's logic backward to clock values from 1997–98. All ten prime-curve seeds matched Unix timestamps between May 1997 and April 1998.

The most concrete reproduction is P-256: feed the Unix timestamp of August 16, 1997, 01:52:34 into lrand48, run it 1,842 times, and out comes exactly C49D3608 86E70493 6A6678E1 139D26B7 819F7E90 from the standard. Anthropic published the reproduction code so anyone can rerun it. Cryptographer Filippo Valsorda independently reimplemented the solution in Go and confirmed the match.

The work was done by a ten-person Anthropic team (John Wood, Henry de Valence, Ava Howell, Zack Voase, Lucy Sweet, Amir Omidi, Paul Crowley, Iain McGinniss, Nicholas Carlini, Steve Weis). Anthropic stresses: this is not a cryptographic break, not a new attack, no new ECDSA weakness — reproducibility means "much less room for subversion and that we can be confident the parameters are secure."

Background: in 2000, NIST adopted NSA-supplied curves in FIPS 186-2, each with a 20-byte "seed" — the seed is hashed to set one curve coefficient, meant to prove nobody hand-picked a curve with a hidden weakness. But the NSA never explained how the seeds were chosen, and suspicion deepened after the Snowden disclosures: NSA mathematician Jerry Solinas said in 2015 the seeds were hashes of a joke phrase like "Give Bob and Jerry a raise," without remembering details; Solinas died in 2023; that year Valsorda offered a $12,288 bounty, tripled to $36,864 if donated to charity. The bounty will now go to ISRG, the nonprofit behind Let's Encrypt.

Still unexplained: the B-163 binary-curve seed "fits nothing Claude has tried," and how the base points of P-224, P-256, P-384 and P-521 were generated is unknown. Bitcoin is unaffected: it uses secp256k1, whose parameters are too simple to leave room for a hidden weakness.

Key facts

1. Finding: Seeds of five NIST curves (P-192/P-224/P-256/P-384/P-521) are lrand48 output seeded with Unix timestamps
2. Time: Under half an hour; P-256's seed was the 1,842nd candidate from the Aug 16, 1997 01:52:34 run
3. Method: Statistical fingerprint in seed bits → LLL lattice recovery of hidden generator state → rewind to 1997–98 clock values
4. Verification: Anthropic published reproduction code; Filippo Valsorda independently confirmed with a Go reimplementation
5. Bounty: $36,864 will be donated to ISRG, the nonprofit behind Let's Encrypt
6. Open: B-163 seed and four curves' base-point generation still unknown; not a break, no action needed