Anthropic says its model traced origin of NIST elliptic curve seeds to 1990s timestamps
The company says the long-unexplained seeds behind several ECDSA curves came from a common C random-number generator seeded with the clock, not a hashed phrase.
The seed values behind several widely used elliptic curves, which have gone unexplained since the curves were standardized, were produced by an ordinary C library random-number generator seeded with a Unix timestamp, according to a research post published by Anthropic. This article relies on that single source, and Anthropic is describing work done by its own model.
Anthropic said the curves are part of ECDSA, which NIST adopted in 2000 in the FIPS 186-2 Digital Signature Standard. The published "seed" values used to define the curves were provided by the NSA with no explanation, the company wrote. That gap led to years of suspicion, an amateur investigation and a bounty for anyone who could find the seeds' origins.
According to the post, an Anthropic employee asked an internal research model, Claude, in October 2026 to work out how the seeds were made. In under half an hour it found the origins of the NIST P-192, P-224, P-256, P-384 and P-521 seeds. Anthropic said none came from a hash. They were output from the lrand48 generator, initialized with Unix timestamps that fall between May 1997 and April 1998. A popular theory that they were a hash of a humorous passphrase "turned out to be wrong," the company wrote.
Anthropic argues the finding should increase trust in the curves, not reduce it.
“This is not a cryptographic break, new attack, or weakness in the ECDSA curves.”Anthropic research post
The company said a simple generator started from the clock, which anyone can now reproduce, "leaves much less room for subversion." It also reported that the base points of P-192 and five ANSI X9.62 example curves came from the random-number generator in FreeLIP, Arjen Lenstra's long-integer arithmetic package.
Several questions remain open, by Anthropic's own account. The seed for the binary curve B-163 "remains unexplained." The company said it does not know how the base points for P-224, P-256, P-384 and P-521 were generated, or those for the NIST binary curves.
Anthropic also found that some viable candidate curves were skipped during generation. For P-256, the published seed was candidate 1,842, but candidate 876 would also have worked. The company said it does not know what criteria were used, or whether this was an unintentional artifact. It said it does not believe weakened curves were picked, though it acknowledged that choosing curves with a specific property by searching over timestamps is "still conceivable" in principle.
The post notes that Jerry Solinas, the longtime NSA employee linked to the passphrase theory, died in 2023. Anthropic said the $36,864 bounty, which it credits Filippo Valsorda with organizing, will be donated to the Internet Security Research Group.
