Claude traces NSA elliptic curve seeds to standard random-number generator

An AI model has solved a 25-year cryptography puzzle by tracing mysterious numbers supplied by the NSA to a standard random-number generator, reducing the likelihood of a hidden backdoor in widely used encryption standards. The finding does not require changes by users of the affected curves, but raises fresh questions about how the NSA selected other elements of the cryptographic designs.

• Claude, an Anthropic AI model, took less than 30 minutes to identify that five NIST elliptic curve seeds originated from lrand48, a standard random-number generator using timestamps from 1997 and 1998.
• The NSA provided the unexplained seeds in the late 1990s, and the U.S. National Institute of Standards and Technology adopted them in 2000 without disclosing their origins, fueling 25 years of suspicion about a potential backdoor.
• Bitcoin’s secp256k1 curve was unaffected by the mystery because it uses a simpler design with fixed parameters, leaving little room for concealed weaknesses, though quantum computers pose a separate future threat.

• 25 years Duration cryptographers pursued an explanation for unexplained NSA-supplied curve seeds
• 30 minutes Time an Anthropic AI model took to solve the mystery this month
• $36,864 Bounty awarded to Internet Security Research Group, nonprofit behind Let’s Encrypt
• 1,842 Candidate iteration where Claude found exact match for P-256 curve seed

CoinDesk reported that an Anthropic employee tasked the company’s internal research model with tracing the origin of five seed values that the NSA had provided to NIST in the late 1990s without explanation. The mystery deepened after Edward Snowden’s disclosures revealed NSA efforts to weaken cryptographic standards, particularly through the Dual EC random-number generator, which NIST later removed from its recommendations. For decades, cryptographers questioned whether the NSA had tested multiple candidate curves until finding one with a weakness only the agency could exploit. Claude reproduced the sequence behind P-256, one of the most widely used elliptic curves, and traced it to lrand48, a pseudorandom number generator built into older C software libraries. The model verified the match at the 1,842nd candidate generated by the program seeded with timestamps from 1997 and 1998.

Claude’s discovery ends a quarter-century of cryptographic uncertainty

The breakthrough addresses a puzzle that had consumed the attention of leading cryptographers since 2000. Cryptographers Neal Koblitz and Alfred Menezes examined the controversy in their 2015 paper, “A Riddle Wrapped in an Enigma,” with Menezes recalling his 1997 receipt of the seeds directly from NSA mathematician Jerry Solinas. Security researcher Steve Weis filed public-records requests in 2018 seeking documentation, but NIST reported having none while the NSA declined to respond. In 2023, cryptography engineer Filippo Valsorda and other contributors announced a $12,288 bounty for an answer, eventually rising to over $36,000 if donated to charity, yet the mystery persisted through Solinas’s death that same year.

The Anthropic model’s findings, recorded in its reasoning chain, demonstrated the logical certainty of the match: “All top bits clear–20 bits, chance 1e-6. So indeed real-world.”

This is astonishing: it solves the 25-year-old mystery.

Claude, Anthropic research model

The discovery reduces but does not eliminate questions about curve design

Anthropic stated that the traceability of the seeds to an ordinary, documented program makes a hidden weakness much less plausible, since anyone can now independently verify the numbers by running lrand48 with the same timestamps. However, the team cannot explain why the program passed over some usable candidates before reaching the published seed, nor can it account for how other elements of the curves were selected. The predictability that allowed Claude to succeed would be catastrophic in a wallet application: a secret key generated with lrand48 could be recreated by anyone determining approximately when it was created, providing complete access to funds. The NSA’s seeds were public from day one, eliminating any secret to exploit.

Anthropic advised users of the NIST curves that no action is required following the discovery.

Bitcoin’s simpler curve design provided natural protection against hidden weaknesses

Bitcoin was never part of the NSA seeds mystery. The cryptocurrency uses secp256k1, an elliptic curve defined by a simpler equation with two small, fixed numbers that leave minimal room for anyone to introduce a concealed weakness. Bitcoin’s curve carries far fewer adjustable parameters than P-256, which contains a 77-digit number derived from the NSA’s unexplained seed. Creator Satoshi Nakamoto never publicly explained the choice of secp256k1, and the curve saw little use before Bitcoin made it prominent. Ethereum later adopted it, and Bitcoin retained the curve through its 2021 Taproot upgrade despite introducing a newer signature style.

A different threat looms from quantum computing. A sufficiently powerful quantum computer could work backward from a public key visible on Bitcoin’s blockchain to derive the secret key behind it, regardless of how the curve was chosen or whether any backdoor existed. Google reported this week that its Willow chip reduced errors by approximately 40-fold in one of the most expensive computational steps such a machine would require, narrowing the gap between theoretical attack and practical capability. No quantum computer has yet achieved the scale or reliability needed to crack a Bitcoin key, and no clear timeline exists for when one might arrive.

The BlockWest read. The NSA seeds were public by design and could never have functioned as a secret backdoor. Claude’s solution matters not for Bitcoin or Ethereum, whose users face no exposure from how the seeds were chosen, but for institutions managing systems that depend on P-256 or other affected curves. The real lesson is that cryptographic decisions made in closed settings, even when technically sound, invite decades of institutional doubt.

The $36,864 bounty will go to the Internet Security Research Group, the nonprofit operating Let’s Encrypt, which provides free security certificates to websites. NIST’s elliptic curve standards, adopted 26 years ago, remain in use across financial infrastructure, government systems, and corporate networks–and now face a fresh round of scrutiny about whether other design choices in those standards require similar explanation.

BlockWest is a news publication. Nothing here is investment advice. Read our disclaimer and editorial policy.