Anthropic Says Claude Cracked the Decades-Old NIST P-256 Seed Mystery in Under 30 Minutes: It Was a 1997 Timestamp, Not a Backdoor

The seeds behind NIST’s P-256 and the other standard elliptic curves were not hashes of a forgotten joke phrase. They came from a plain 1990s C random number generator, started from the computer’s clock on dates between May 1997 and April 1998. That is how Anthropic says it solved the NIST curve seeds mystery in a post on 16 October 2026, after one of its internal Claude research models worked it out in what the company says was under half an hour.

The result closes a question cryptographers have argued about since NIST put these curves into FIPS 186-2 in 2000. It also claimed a bounty that had sat open for three years. The Anthropic team chose to send the full $36,864 to the Internet Security Research Group, the non-profit that runs Let’s Encrypt.

We did not take the claim on trust. Anthropic published its code, so we ran it, checked the output against the standards documents, and pushed the P-256 result one step further to the curve itself. Here is what holds up, what is still unexplained, and what it means if you ship code that signs anything.

What Anthropic says Claude found

Every NIST prime curve has a published 20-byte “seed”. The seed is hashed with SHA-1 to produce one of the curve’s coefficients, which is meant to prove nobody hand-picked a weak curve. The catch was that nobody knew where the seeds came from. According to Anthropic’s write-up, they “were provided by the NSA with no explanation or justification.”

The long-running story was that the late Jerry Solinas, a longtime NSA employee, hashed a humorous sentence along the lines of “Give Bob and Jerry a raise”. Anthropic says several of its staff chased that tip and failed. When an employee asked an internal research model to look at the problem without the hint, the model tried a different idea: guess what kind of software would have generated random numbers in the 1990s.

The answer was srand48() seeded with a Unix timestamp, then lrand48() drawing bytes until a 20-byte candidate produced a valid curve. P-256’s seed is candidate number 1,842 from a run started at 01:52:34 UTC on 16 August 1997. Anthropic says the model first noticed that four of the seeds had a zero top bit in every 32-bit word, a pattern it puts at roughly 1 in 5,810 odds by chance and a known fingerprint of lrand48. It then used the LLL lattice algorithm to recover the generator state for the prime curves.

Anthropic did not name which Claude model did the work. Posts on X have attached various model names to it, but we found no official confirmation, so treat those as unconfirmed.

We reran the code: here is what checked out

Anthropic released its reproduction script under CC0. We ran it unchanged on our own machine. It printed all 14 seeds in under a tenth of a second, which tells you how small the problem really was once the right guess was made.

We then compared the output with two independent references. Nine of the seeds, covering P-192, P-224, P-256, P-384, P-521 and the four binary B-curves, appear character for character in the SEC 2 v2 curve standard. The five extra ANSI X9.62 example seeds match the list in Filippo Valsorda’s original bounty post.

Matching a seed is only half the chain, so we also ran the reproduced P-256 seed through the FIPS 186 SHA-1 procedure that turns a seed into the value c. For the curve to be honest, the published coefficient b must satisfy b² × c ≡ -27 (mod p). It does. In plain terms, the clock time 871696354 leads, step by step, to the exact P-256 curve that runs in browsers and servers today.

Confirmed vs still unexplained

The write-up is unusually upfront about its gaps, and those gaps are where the remaining conspiracy talk will go, so they are worth laying out.

Valsorda found one extra rule in the skipped candidates: seeds were rejected if the curve’s order had more bits than its field. That still leaves roughly twice as many valid seeds as were published, and he says he found “no good fit” for the rest.

Does this change P-256 security?

No, and both Anthropic and Valsorda say so plainly. Anthropic calls it “not a cryptographic break, new attack, or weakness” and says there is “no action to be taken”. The point of the finding is the opposite of a scare: it shrinks the room anyone had to sneak in a weak curve.

Valsorda’s post announcing the claimed bounty puts a number on it. A 2017 idea from Daniel Bernstein and Tanja Lange needed about 70 bits of freedom in seed choice to target a hypothetical class of weak curves. With seeds pinned to a clock in 1997 and 1998, he estimates the NSA would have had “barely 30 bits of freedom”, which he says rules that technique out. He now personally recommends the NIST curves over Curve25519, then adds the obvious joke: just in time for them to be retired for post-quantum signatures.

The older argument still stands too. In their paper “A Riddle Wrapped in an Enigma”, Neal Koblitz and Alfred Menezes argued that a seed-based backdoor would need a weak-curve class so large that someone in academia would have found it by now.

The AI angle, with a little skepticism

This is a good example of a model being useful in a way that is easy to check. The answer is a short script anyone can run, and an outside expert, bounty organiser Filippo Valsorda, reimplemented it in Go and confirmed it. That beats most AI capability claims, which rest on benchmarks the vendor picked.

Still, keep the framing in proportion. The “under half an hour” figure is Anthropic’s own and cannot be checked from outside. The hard step was a change of hypothesis, from “hash of a phrase” to “1990s random number generator”, and the published reasoning shows the model even stopped to ask whether it was inside a test. It joins other recent lab claims, like OpenAI’s Astra solving open math problems, where the result matters more than the speed boast.

It also fits Anthropic’s wider security push, including its free OSS Scanner for open source projects. A model that can recover generator state from 20 bytes is also a model that will be good at spotting weak randomness in live code.

What it means for Indian developers

If your app signs JSON Web Tokens with ES256, you are already using P-256. The JOSE standard, RFC 7518, defines ES256 as “ECDSA using P-256 and SHA-256”, and Valsorda notes that P-256 and P-384 back the ECDSA certificates that secure much of the web. Nothing here tells you to rotate keys or switch curves.

The real lesson is in how the 1997 code worked. A clock-seeded, non-cryptographic generator is fine for picking public parameters, because those are published anyway. It is a disaster for secrets. If you generate OTPs, API keys or session tokens, use secrets in Python, crypto.randomBytes in Node.js or SecureRandom in Java, never rand(), Math.random() or anything seeded with the time.

Finally, keep post-quantum migration on your roadmap. NIST has already published ML-DSA as FIPS 204 for signatures, and that shift, not this seed story, is what will eventually move teams off P-256. Leaked credentials remain the more immediate risk, as the recent OpenCode Console key breach showed.

FAQ

Were the NIST elliptic curves backdoored?

There is no evidence of that, and this finding makes it less plausible. The seeds trace to clock times in 1997 and 1998, which leaves far too little freedom to pick a secretly weak curve, according to Anthropic and bounty organiser Filippo Valsorda.

Do I need to change anything if I use P-256 or ES256?

No. Anthropic says there is no action to take. This explains where the curve parameters came from; it does not reveal any attack on them.

Who got the bounty money?

The Anthropic team claimed the bounty on 15 October 2026 and donated it to the Internet Security Research Group, which runs Let’s Encrypt. Donating tripled the $12,288 bounty to $36,864.

What is still unknown about the NIST curves?

The B-163 seed, the base points of P-224, P-256, P-384 and P-521, and the reason some valid candidates were skipped all remain unexplained.

Can I verify the result myself?

Yes. Anthropic’s write-up includes public-domain Python code that regenerates the seeds in a fraction of a second. You can compare its output with the seeds printed in SEC 2 or FIPS 186.