Claude Traces NIST ECDSA Curve Seeds to Unix Timestamps

Anthropic researchers and its Claude model have solved a decades-old mystery over the origin of seed values used in NIST's widely deployed elliptic-curve digital signature standard, showing that the values were likely generated by the C library pseudorandom number generator lrand48 initialized with a Unix timestamp, not from a secret NSA passphrase. The finding addresses questions raised since the 2000 adoption of FIPS 186-2, which specified standard elliptic curves for ECDSA but provided seeds for the curves without documenting how they were chosen. The standard includes seeds for curves such as P-192, P-224, P-256, P-384 and P-521. Because the parameters were supplied by the NSA and the provenance was unclear, cryptographers have long debated whether they could conceal weaknesses. A well-known theory from former NSA employee Jerry Solinas suggested the seeds might have come from a humorous passphrase, but that account was never verified and Solinas died before the question was settled. According to Anthropic, an internal research model identified the generator by scanning published seeds for signatures of 1990s-vintage random-number generators. The model found high-bit patterns consistent with lrand48, which outputs only the top 31 bits of a 48-bit internal state. Researchers then recovered the truncated generator state using lattice reduction and stepped it backward to initialization values whose low 16 bits match the format used by srand48. The resulting values correspond to Unix timestamps between May 1997 and April 1998 for prime-field curves, while binary-curve initializations appear consistent with April 1998 timestamps, possibly halved. The team said the method reproduces the official seeds exactly. The discovery is not a cryptographic break and does not require users to change existing ECDSA parameters. Anthropic said the result makes deliberate NSA backdoors less plausible because the seeds can now be reproduced through a simple, transparent process rather than remaining unexplained. The work closes a long-running public debate and reduces reliance on trust alone for one of the most widely used public-key standards. Researchers also identified a likely origin for some base points in ANSI X9.62 example curves, tracing them to the random number generator in FreeLIP, Arjen Lenstra's long-integer arithmetic package. The recipe used a small generator seed, discarded initial outputs, and tested reduced candidate values until a point lay on the curve. However, the team could not explain how the base points for P-224, P-256, P-384 and P-521 were selected, and one binary curve seed, B-163, remains unexplained. They also did not determine why some curve candidates were skipped during generation, although they said the number of skipped candidates does not suggest weak curves were deliberately chosen. The original seed investigation included a bounty organized by Filippo Valsorda. Anthropic said the $36,864 award will be donated to the Internet Security Research Group. The researchers credited Solinas, whose earlier passphrase theory misled investigators for years, and described the result as a final chapter in a long-standing cryptographic enigma.