Claude reveals ECDSA curve origins
A · Strong evidence Anthropic's Frontier Red Team (including Nicholas Carlini) reports how a model traced the NIST curve seeds, with public code that reproduces every recovered seed and base point.
Summary based on the full text·Original: about 12 minutes to read
In short
Anthropic (16 October 2026) reports that an internal Claude research model solved a long-standing cryptography question: where the "seeds" behind the NIST ECDSA elliptic curves came from. The seeds were not hashes of a joke phrase, as rumoured, but outputs of the C library's lrand48 random number generator seeded with Unix timestamps from 1997-98. The authors say this makes a hidden backdoor less plausible, not more.
Key numbers
- under half an hourtime the internal research model took to find the origins of the NIST P-192 to P-521 seeds
- 1,842generator iterations needed to produce the published P-256 seed
- May 1997 and April 1998date range of the Unix timestamps that seeded the ten prime-curve seeds
- $36,864seed bounty, donated to the Internet Security Research Group
As reported by the source.
English·Web page·opens anthropic.com
What it reports
- The NSA supplied the seeds without explanation in 2000, fuelling suspicion of deliberate weaknesses and a public bounty.
- The model guessed that 1990s software used a weak pseudo-random generator, wrote a scanner, and spotted top bits that were always zero (chance 1 in 5,810), a signature of lrand48.
- For prime-curve seeds it recovered the generator state with LLL lattice reduction and stepped it back to srand48 initialisation. All ten prime-curve initialisations are timestamps between May 1997 and April 1998; P-256 is candidate 1,842 of its run.
- Binary-curve seeds read as February 1984, which doubled maps to 17 April 1998, suggesting the clock was halved.
- It also explained six base points (P-192 and five ANSI X9.62 curves) as outputs of the FreeLIP generator with small seeds such as 20000.
- Open questions: why some valid candidate curves were skipped (P-256's candidate 876 also works), the B-163 seed, and base points for P-224 to P-521.
How they got it
A staff member asked the model without pointing to the rumoured clue. The post includes the model's reasoning, including its check on whether it was in a test, and Python code reproducing the seeds and base points.
Limits
- Several curve choices remain unexplained; the selection criteria for skipped candidates are unknown.
- Reported by the model's developer.
- Speed claim is for the discovery; staff verified and wrote it up.
Why it matters for companies
No action is needed on ECDSA itself; the authors say so. The wider signal is that models can now settle open technical questions by forming hypotheses and checking them computationally. For security teams, this cuts both ways: old weak randomness and undocumented parameters in legacy systems are now cheap to analyse, by defenders and attackers alike.
Summary based on the full text. Read the original for the full argument and data.Read the original on anthropic.com
- Tags
- AI for science