Claude traces NSA-supplied NIST curve seeds to lrand48 generator in under 30 minutes, per Anthropic

Anthropic says its Claude model identified the origin of the seeds behind several NIST-standardized elliptic curves in under 30 minutes. The seeds came from lrand48, a simple C random number generator, initialized with a Unix timestamp between May 1997 and April 1998. The origin of these seeds had been unexplained for 25 years.

The mystery

NIST standardized several curves in the ECDSA standard, the most widely used framework for elliptic-curve digital signatures, in 2000. The NSA supplied the seeds, the starting values used to generate the curve parameters, without explaining how they were created. That gap fueled suspicion that the curves might contain a backdoor.

The question attracted a bounty and amateur sleuthing efforts. The late NSA employee Jerry Solinas had suggested the seeds were a hash of a humorous phrase. That explanation turned out to be wrong.

What Claude found

According to Anthropic, Claude spotted the pattern because lrand48 outputs only 31 bits. The top bits in some of the seeds were systematically zero, which matched that constraint. From there, Claude determined that the generator had been initialized with a Unix timestamp from a window between May 1997 and April 1998.

Confirmed vs. claimed

• Reported by Anthropic: the lrand48 origin, the timestamp window, and the under-30-minute solve time.
• Anthropic's interpretation: the finding makes deliberate backdoors less likely. This is an inference, not a proof.
• Not disclosed in the source reporting: which Claude model was used, what tooling or prompting was involved, how much human guidance the run had, and whether outside cryptographers have independently verified the result.

The bounty

Anthropic is donating the $36,864 bounty to the Internet Security Research Group (ISRG).

What this means

This is a single demonstration, not a benchmark result, and it comes with no scores or reproducible methodology. Its value is as an example of a model finding a structural regularity, the zero top bits matching a 31-bit generator output, that human researchers missed for decades.

The search space was also small. A window of roughly one year contains about 30 million possible one-second timestamps, which is trivial to brute-force once the generator is identified. The hard part was recognizing which generator to test, and that is the step Anthropic credits to Claude. Without the model name or run details, the result is difficult to evaluate or reproduce.

The backdoor claim deserves caution. Explaining where the seeds came from resolves the specific complaint that they were unexplained. It does not by itself audit the curves, and Anthropic's conclusion remains its own assessment. Independent cryptographic review of the finding is the next thing to watch for.