# Claude AI Decodes Decades-Old Cryptographic Standard Origins Anthropic researchers used Claude to solve the mystery behind NIST elliptic curve seeds. - **Source:** [Hacker News](https://news.ycombinator.com) - **Published:** 2026-10-16 - **Topic:** [Data & AI](https://brifing.si/c/data-ai) - **Original article:** - **On Brifing:** https://brifing.si/s/d5b8c7e8-224b-4750-8286-cd59deb61839 ## Deciphering Cryptographic Origins The origins of NIST elliptic curve seeds, a mystery spanning decades, have finally been explained. Anthropic researchers utilized Claude to investigate the provenance of these parameters, which were originally provided by the NSA without justification. This discovery marks the end of years of speculation regarding potential hidden backdoors within these widely used standards. ## The Flawed Seed Hypothesis Previous theories suggested that the seeds were generated using a hash of a humorous passphrase, a rumor linked to NSA employee Jerry Solinas. Anthropic researchers attempted to verify this hypothesis unsuccessfully. Claude eventually bypassed these rumors by analyzing the software environment of the 1990s, successfully identifying the true generation mechanism used. ## Claude's Analytical Breakthrough In under thirty minutes, Claude determined that the seeds were not hash-based but outputs of the C library’s lrand48 random-number generator. The generator was initialized using a Unix timestamp. Claude identified this by scanning for patterns in the top bits of the seeds, which matched the signature of the 1990s-vintage linear congruential generator. ## Mathematical Pattern Recognition Claude identified that four of the ten seeds contained a zero in the top bit for all twenty words, a pattern occurring by chance with a probability of 1/5810. By recognizing this signature, the model recovered the internal state of the generator, proving the seeds were derived from simple, reproducible pseudorandom number sequences. ## Solving Lattice Problems For prime-curve seeds, Claude recovered the internal state of the truncated linear congruential generator by treating it as a textbook lattice problem. The model applied the Lenstra–Lenstra–Lovász basis reduction algorithm to solve for the state. This confirmed that each forty-eight-bit state perfectly regenerated the full one hundred sixty bits of the seeds. ## Timestamp-Based Initialization By stepping the generator backwards, researchers confirmed that the srand48 initializations corresponded to specific Unix timestamps. The prime-curve seeds were generated between May 1997 and April 1998. The binary-curve initializations mapped to February 1984, suggesting a potential clock-halving mechanism was employed during the generation process for those specific cryptographic parameters. ## Base Point Provenance Beyond the seeds, Claude investigated the origin of the base points, G, for the curves. It discovered that base points for six curves generated in May 1997 originated from the random number generator in Arjen Lenstra’s FreeLIP arithmetic package. This provides further transparency into how these fundamental cryptographic components were initially constructed. ## Unexplained Curve Parameters Despite the success, some mysteries remain. The base points for P-224, P-256, P-384, and P-521 do not fit the identified FreeLIP recipe, and their selection process remains unknown. Additionally, the fifth binary seed, B-163, did not match any of the patterns Claude tested, leaving its specific generation method currently unexplained by the team. ## Security Implications Confirmed These findings do not represent a cryptographic break or a new vulnerability. Instead, they increase confidence that the curves were chosen without intentional backdoors. The simple, reproducible nature of the generation process makes the existence of deliberate subversion significantly less plausible, reinforcing the overall security posture of the NIST elliptic curve standards. ## Skipped Candidate Observations The investigation noted that some potentially viable curves were skipped during the generation runs. For instance, P-256 used candidate 1842, while candidate 876 was also viable. Because the number of skipped candidates is small, researchers do not believe this indicates weakened curves were intentionally selected, viewing it as a likely unintentional artifact. ## Collaborative Research Effort The research was conducted by a team at Anthropic including John Wood, Henry de Valence, and Nicholas Carlini. The bounty of $36,864 for finding the seeds, organized by Filippo Valsorda, will be donated to the Internet Security Research Group. The team also posthumously recognized Jerry Solinas for his historical role in this controversy. ## Closing the Speculation Chapter This work demonstrates the efficacy of AI in solving complex historical technical problems. By reverse-engineering the 1990s software environment, the team provided clarity on a long-standing cryptographic concern. Users can continue using these standards with increased confidence, as the mystery of their origin has been effectively resolved through rigorous computational analysis. ## Sources covering this story - https://www.anthropic.com/research/ecdsa-curve-origins — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._