A decades old question about the origins of the NIST elliptic curve seeds appears to have a reproducible answer, and the path to it offers a glimpse of what AI assisted research can become.
October 2026 | Cryptography | AI Research | Anthropic
For more than a quarter of a century, five strings of numbers sat quietly inside one of the world’s most important cryptographic standards.
They were public. Anyone could inspect them. Cryptographers knew exactly how they were used. What nobody could explain was something much simpler.
Where had they come from?
The numbers were the seeds used in the construction of the NIST elliptic curves P 192, P 224, P 256, P 384 and P 521. These curves became part of modern public key cryptography after NIST standardized them in 2000. P 256 and P 384 in particular became widely used in digital signatures and web security.
The seeds themselves had been supplied through work involving the US National Security Agency in the late 1990s. Their values were published openly, but their origin was not documented. That missing piece produced one of those peculiar mysteries that can survive for decades precisely because everything around it works.
Then, in October 2026, an Anthropic employee handed the puzzle to an internal Claude research model.
According to Anthropic, Claude found the answer in less than half an hour.
It was not an elaborate hidden message. It was not a secret mathematical construction. It was, rather wonderfully, a computer clock.
The strange numbers inside a trusted standard
Elliptic curve cryptography sounds intimidating, but the important part of this story is surprisingly understandable.
An elliptic curve used for cryptography is defined by mathematical parameters. Certain curves are safe to use while others can have properties that make them unsuitable. When standards were being developed in the 1990s, researchers therefore needed a way of choosing curves without giving the person choosing them too much freedom.
The NIST curves used a procedure derived from the ANSI X9.62 standard. A published seed was processed with SHA 1 and used to generate part of the curve. Anyone could take the seed afterwards and confirm that it produced the published parameters.
This was described as a way of generating curves verifiably at random.
There was one awkward problem. You could verify what happened after the seed was chosen, but you could not verify how the seed itself had been chosen.
That distinction mattered.
Imagine that somebody tells you they rolled dice to choose a number and then publishes both the number and everything they calculated from it. You can reproduce the calculations perfectly. But unless you saw the dice roll, you still do not know whether that first number was genuinely random or carefully selected.
Cryptographers noticed this problem very early. The concern was not that anyone had demonstrated a weakness in the NIST curves. They had not. The uncomfortable question was whether an organization that knew some secret class of vulnerable curves might theoretically search through many possible seeds until it found one with a hidden property unknown to everyone else. Researchers debated this possibility for years.
The NSA’s later history did little to make people less suspicious.
A completely separate NIST random number generator called Dual EC DRBG became the subject of serious backdoor concerns after the Snowden disclosures. NIST eventually removed it from its recommendations. Dual EC DRBG and the NIST elliptic curve seeds are different issues, and the problems with one do not prove anything about the other. But the episode demonstrated why unexplained cryptographic constants supplied by an intelligence agency could attract uncomfortable questions.
A forgotten story about a joke
There was, for years, an apparently charming explanation.
Jerry Solinas, an NSA mathematician involved in the development of the curves, recalled that the seeds had been derived from humorous English phrases. In correspondence later published by cryptographers Daniel Bernstein and Tanja Lange, Solinas remembered something roughly along the lines of a joke asking for a raise.
Unfortunately, he could no longer remember the exact sentence or precisely how it had been processed. The original files were apparently lost as well.
Solinas died in 2023, leaving the story unresolved.
That same year, cryptography engineer Filippo Valsorda turned the mystery into a public challenge.
He announced a $12,288 bounty for recovering the origins of the five prime curve seeds. If the winner donated the money to charity, the contributors would triple the prize to $36,864.
Password crackers, cryptographers and curious researchers now had a very specific treasure hunt.
The natural approach was to search for the forgotten phrase. People tried. Nothing worked.
Claude stopped looking for the sentence
This is where the story becomes particularly interesting from an AI perspective.
Anthropic says several of its own employees had previously investigated the phrase theory without success. In October 2026, one employee instead gave the problem to an internal Claude research model without telling it to follow that clue.
Claude approached the mystery differently.
Rather than asking what sentence might have produced the seeds, it began asking what software in the late 1990s might have produced numbers that looked like them.
That change in perspective turned out to be everything.
Claude suspected an old pseudorandom number generator.
Pseudorandom generators produce sequences of numbers that appear random but are actually determined by an initial state. Give the generator the same starting value and it will generate the same sequence again.
Claude wrote code that examined the published seeds and tested patterns associated with generators that would have been common when the curves were created.
One pattern stood out.
Some of the bits were behaving exactly as expected from lrand48, a simple random number generator found in C libraries of the era.
Claude then worked backwards from the visible numbers toward the generator’s hidden internal state.
For some of the truncated values, this required something much more interesting than simple pattern matching. The model used a mathematical technique based on the Lenstra, Lenstra and Lovász lattice reduction algorithm, commonly known as LLL, to reconstruct information that had been removed from the generator’s output.
Once it recovered the internal state, it could run the generator backwards.
Eventually it reached the form produced when srand48 initializes the generator.
And the values sitting there looked like Unix timestamps. Dates. Times. Computer clocks.
August 16, 1997
One of those timestamps corresponds to August 16, 1997 at 01:52:34 UTC.
Start the old generator from that moment and let it produce candidate seeds.
Eventually, candidate number 1,842 is C49D360886E704936A6678E1139D26B7819F7E90.
That is the published seed for NIST P 256.
The same approach reconstructed the origins of the other prime curve seeds. The recovered timestamps fall between May 1997 and April 1998.
Claude also connected five additional prime curve seeds from ANSI X9.62 to the same basic process.
The mystery that had inspired years of speculation was apparently the residue of a small program running in the late 1990s, taking the current time, feeding it into a standard random number generator and trying candidate values until suitable curves appeared.
There is something almost poetic about that.
A modern frontier AI reconstructed the behavior of software written nearly thirty years earlier by recognizing the mathematical fingerprints the old program had unknowingly left behind.
Then a human cryptographer checked it
An extraordinary result is not valuable merely because an AI says it found one. The important next step was verification.
Filippo Valsorda independently reimplemented the reconstruction in Go and confirmed that it reproduced the seeds. The Anthropic team submitted its result on October 15, claiming the bounty. Because the team chose the charitable option, the $12,288 prize became a $36,864 donation to the Internet Security Research Group, the nonprofit organization behind Let’s Encrypt.
Valsorda wrote that the discovery fills in a missing page of cryptographic history and increases confidence in the curves.
Anthropic also published code allowing others to reproduce the result.
That detail is perhaps as important as Claude finding the pattern in the first place. The answer did not have to be trusted because it came from a powerful model. It could be checked because it produced a concrete mathematical reconstruction that other people could run independently.
So was there a backdoor?
No evidence from this discovery suggests one.
And nothing about the result breaks ECDSA.
No one needs to replace keys because of it. No encrypted communications have suddenly become readable. P 256 has not been cracked.
In fact, the result points in the opposite direction.
Before the reconstruction, one hypothetical concern was that whoever generated the seeds might have searched through an enormous space of possibilities until finding curves with some secret weakness.
The reconstructed process sharply reduces how much freedom the designers appear to have had.
Valsorda argues that even under generous assumptions about which timestamps and candidate curves could have been selected, the available freedom would be far too small to support previously proposed methods for secretly targeting an extremely rare class of vulnerable curves.
For practitioners who already trusted these curves, the discovery therefore strengthens an existing conclusion rather than overturning one.
But the mystery is not completely finished
Cryptography rarely gives us an ending without leaving another question behind.
The reconstruction explains the five major NIST prime curve seeds remarkably well, but Anthropic identified pieces that remain unresolved.
For P 256, for example, candidate number 876 from the same random sequence also appears to produce an acceptable prime order curve. Yet it was skipped. The published curve came from candidate 1,842.
Other sequences contain similar skipped candidates.
Why? Nobody currently knows.
There may have been additional selection criteria. The original software may have performed another calculation that consumed random values. There could have been an implementation bug. The computational tools available in 1997 were also very different from those available today.
Anthropic was also unable to reconstruct the seed for the binary curve B 163 using the same method, and the origins of several base points used in the standardized curves remain unexplained.
So the door has not been completely closed. But the largest part of the mystery now has a reproducible answer.
The more interesting story may be what the AI actually did
There is an understandable temptation to summarize this as: Claude solved a 25 year old cryptography problem in thirty minutes.
That is true in one sense, according to Anthropic’s account, but it hides what makes the episode genuinely interesting.
Claude was not simply asked a trivia question whose answer already existed somewhere in its training data. The answer was not known publicly.
The model formed a hypothesis about how programmers in the 1990s might have generated the numbers. It wrote programs to test that hypothesis. It examined statistical structure. It recovered hidden state from incomplete outputs. It used lattice mathematics when straightforward reconstruction was not enough. It reversed the generator and connected the resulting states to historical timestamps.
Then humans reproduced and checked the result.
This is a very different kind of AI achievement from answering a difficult question correctly. It looks much closer to research.
There are important limits. An Anthropic employee chose the problem. Humans supplied the environment in which the model could investigate it. Anthropic researchers examined the result, extended the investigation and prepared the publication. Independent experts then verified the central claim.
This was not an AI wandering through mathematics one evening and deciding by itself to settle cryptographic history. But neither was it merely sophisticated autocomplete.
The interesting territory lies between those two caricatures.
AI systems are beginning to become useful precisely in problems where they can move between domains: historical clues, old programming conventions, mathematics, code, statistical patterns and repeated computational experiments.
A human specialist might spend years approaching a mystery through its established story. Sometimes the advantage of a model is that it does not feel particularly attached to the story.
Everyone was looking for a forgotten joke. Claude looked at the numbers.
And somewhere inside them, a computer clock from August 1997 was still ticking.
Sources
Anthropic, Claude reveals ECDSA curve origins, October 16, 2026
Filippo Valsorda, The NIST Elliptic Curves Seeds Bounty Has Been Claimed, October 16, 2026
Filippo Valsorda, Announcing the $12k NIST Elliptic Curves Seeds Bounty, October 2023
NIST, Cryptography historical material and the separate Dual EC DRBG controversy
Neal Koblitz and Alfred Menezes, A Riddle Wrapped in an Enigma