---
id: "lib-2026-10-16-claude-reveals-ecdsa-curve-origins"
type: "library"
title: "Claude reveals ECDSA curve origins"
lang: "EN"
org: "Anthropic"
source_type: "Other"
date: "2026-10-16"
week: "2026-W42"
url: "https://nosov.ai/library/lib-2026-10-16-claude-reveals-ecdsa-curve-origins/"
original_url: "https://www.anthropic.com/research/ecdsa-curve-origins"
tier: "A"
tier_name: "Strong evidence"
tier_reason: "Anthropic's Frontier Red Team (including Nicholas Carlini) reports how a model traced the NIST curve seeds, with public code that reproduces every recovered seed and base point."
summary_basis: "full-text"
original_minutes: "12"
tags: ["ai for science", "cryptography"]
---

# Claude reveals ECDSA curve origins

Tier A (Strong evidence): Anthropic's Frontier Red Team (including Nicholas Carlini) reports how a model traced the NIST curve seeds, with public code that reproduces every recovered seed and base point.

Summary based on the full text.

## In short

Anthropic (16 October 2026) reports that an internal Claude research model solved a long-standing cryptography question: where the "seeds" behind the NIST ECDSA elliptic curves came from. The seeds were not hashes of a joke phrase, as rumoured, but outputs of the C library's lrand48 random number generator seeded with Unix timestamps from 1997-98. The authors say this makes a hidden backdoor less plausible, not more.

## Key numbers

- under half an hour: time the internal research model took to find the origins of the NIST P-192 to P-521 seeds
- 1,842: generator iterations needed to produce the published P-256 seed
- May 1997 and April 1998: date range of the Unix timestamps that seeded the ten prime-curve seeds
- $36,864: seed bounty, donated to the Internet Security Research Group

## What it reports

- The NSA supplied the seeds without explanation in 2000, fuelling suspicion of deliberate weaknesses and a public bounty.
- The model guessed that 1990s software used a weak pseudo-random generator, wrote a scanner, and spotted top bits that were always zero (chance 1 in 5,810), a signature of lrand48.
- For prime-curve seeds it recovered the generator state with LLL lattice reduction and stepped it back to srand48 initialisation. All ten prime-curve initialisations are timestamps between May 1997 and April 1998; P-256 is candidate 1,842 of its run.
- Binary-curve seeds read as February 1984, which doubled maps to 17 April 1998, suggesting the clock was halved.
- It also explained six base points (P-192 and five ANSI X9.62 curves) as outputs of the FreeLIP generator with small seeds such as 20000.
- Open questions: why some valid candidate curves were skipped (P-256's candidate 876 also works), the B-163 seed, and base points for P-224 to P-521.

## How they got it

A staff member asked the model without pointing to the rumoured clue. The post includes the model's reasoning, including its check on whether it was in a test, and Python code reproducing the seeds and base points.

## Limits

- Several curve choices remain unexplained; the selection criteria for skipped candidates are unknown.
- Reported by the model's developer.
- Speed claim is for the discovery; staff verified and wrote it up.

## Why it matters for companies

No action is needed on ECDSA itself; the authors say so. The wider signal is that models can now settle open technical questions by forming hypotheses and checking them computationally. For security teams, this cuts both ways: old weak randomness and undocumented parameters in legacy systems are now cheap to analyse, by defenders and attackers alike.

Original: https://www.anthropic.com/research/ecdsa-curve-origins