An internal research model at Anthropic traced the seeds behind several widely used NIST elliptic curves for ECDSA to a mundane 1990s source. In under half an hour, Claude determined that the seeds for the P-192, P-224, P-256, P-384 and P-521 curves came from the C library’s lrand48 pseudorandom number generator seeded with a Unix timestamp, according to an Anthropic research post published Thursday, Oct. 16.
For years the leading rumor held that the seeds came from hashing a humorous or obscure phrase. Anthropic employees had chased that tip without success. That story turned out to be wrong. None of the recovered prime-curve seeds were hash outputs at all.
Claude spotted a statistical pattern: written as 32-bit words, four of the ten seeds have all-zero top bits across their words. The post says the chance of that pattern occurring randomly is 1 in 5,810, a signature of lrand48, which returns only the top 31 bits of a 48-bit state.
The generator was initialized with a Unix timestamp t, then run for n iterations, each drawing 20 bytes as a candidate seed. The standardized P-256 seed emerged as candidate 1,842 from its run. Timestamps for the 10 prime-curve seeds fell between May 1997 and April 1998. Four binary-curve initializations read as February 1984; with the timestamps doubled they map to April 17, 1998, so the program may have halved the clock. The P-256 seed traces to a clock reading of Aug. 16, 1997, at 01:52:34.
Claude recovered the internal PRNG state with brute force for the binary seeds and lattice reduction via the LLL algorithm for the truncated prime-curve outputs. Anthropic stressed the discovery carries no immediate security implications: “This is not a cryptographic break, new attack, or weakness in the ECDSA curves.” The simple, reproducible method makes deliberate backdoors much less plausible, the post says, and no action is required for users or implementers.
The research also connected base points for several May 1997 curves to Arjen Lenstra’s FreeLIP library, using a seed-and-discard recipe. Reproducible code in the post confirms the matches. Some details remain open: the seed for B-163 stays unexplained, and base points for P-224, P-256, P-384 and P-521 have no identified origin yet. Viable candidate seeds were also skipped in certain runs.
The work was conducted at Anthropic by a named cryptography team including John Wood, Henry de Valence, Ava Howell and others listed in the post. Filippo Valsorda organized the related NIST seeds bounty; Anthropic said the $36,864 bounty will be donated to the Internet Security Research Group.