Anthropic said on Friday that an internal Claude research model has finally answered one of cryptography’s most stubborn questions: where the mysterious seed values behind the NIST elliptic curves came from. The answer, published in an October 16, 2026 research report and reached in under 30 minutes, was almost aggressively boring. “It’s just timestamps,” the company’s post begins.

That’s the punchline, and it’s a good one. For roughly 25 years, researchers worried the NSA had cherry-picked the parameters of the internet’s most widely used cryptographic curves, or worse, slipped in a hidden weakness. What Claude found was a garden-variety C-library random-number generator, started with the computer’s clock, run on some workstation sometime between May 1997 and April 1998. Cryptographer Filippo Valsorda, who had put up a $36,864 bounty for the answer, independently reimplemented the solution in Go, confirmed the match, and saw the money donated to the Internet Security Research Group.

A mystery that haunted cryptography for 25 years

Here’s the setup. NIST adopted ECDSA, the Elliptic Curve Digital Signature Algorithm, in its FIPS 186-2 standard in 2000. Digital signatures do the unglamorous work of proving who sent you something and that nobody tampered with it on the way. The standard published seed values that were fed into a SHA-1-based process to derive the curve parameters (P-192, P-224, P-256, P-384 and P-521) but never said where those seeds came from. The NSA supplied them with no provenance.

That gap invited suspicion. For decades, the running theory was that the seeds were hashes of some forgotten English phrase. The late NSA mathematician Jerry Solinas half-remembered phrases like “Give Bob and Jerry a raise” or “Bob and Jerry rule,” and researchers burned years hunting through possible hash inputs. No one ever demonstrated an attack against the curves, but the absence of an explanation was itself the problem: when your entire internet security rests on numbers you can’t account for, “trust us” doesn’t cut it.

How Claude broke it in under 30 minutes

According to Anthropic, an employee asked an internal research model to figure out how the seeds were generated, deliberately without steering it toward the old passphrase theory. Claude found the answer in less than half an hour.

The method, per Anthropic’s writeup, was textbook crypto-forensics. Claude spotted a statistical fingerprint of the old generator in the seed bits: all top bits clear across 20 bytes, a one-in-a-million coincidence if you assume a modern hash. Claude then recovered the generator’s internal state using lattice (LLL) techniques and rewound the clock to the timestamps in use in 1997–98. Ten Anthropic researchers worked the case: John Wood, Henry de Valence, Ava Howell, Zack Voase, Lucy Sweet, Amir Omidi, Paul Crowley, Iain McGinniss, Nicholas Carlini and Steve Weis.

The model’s own notes, as reported by CoinDesk, are worth quoting. “This is astonishing: it solves the 25-year-old mystery,” Claude wrote, after briefly wondering whether it was trapped in a simulated test. “Wow, it’s a real discovery.”

The receipts: timestamps, candidates, and who checked the math

This isn’t vibes-based. Every number is reproducible. The P-256 seed, the string C49D360886E704936A6678E1139D26B7819F7E90, turns out to be candidate number 1,842 from a run of lrand48 seeded with Unix timestamp 871696354. That’s August 16, 1997, 01:52:34 UTC. The P-192 seed took 139 iterations from a timestamp of May 18, 1997. The same pattern held for P-224, P-384 and P-521, with timestamps falling between May 1997 and April 1998.

Claude also explained the base points of six curves, which came from Arjen Lenstra’s FreeLIP library, down to the seeds Claude pinned to specific constants like 20000 for P-192. And Valsorda, the cryptographer who originally posted the bounty, reimplemented everything from scratch and confirmed the match. “AI shedding light on the origins of the NIST EC seeds is a pretty remarkable result,” J. Ayo Akinyele, Ripple’s head of engineering, wrote on X.

What’s still unexplained

Credit where it’s due: the team is honest about the loose ends. The B-163 binary-curve seed “fits nothing Claude has tried and remains unexplained.” And Anthropic concedes it doesn’t know how the base points for P-224, P-256, P-384 and P-521 were generated. The base points for the binary curves showed patterns consistent with timestamps from either February 1984 or April 1998, but that’s a lead, not an answer.

Also worth being precise about what this is not. Anthropic’s framing is blunt: “This is not a cryptographic break, new attack, or weakness in the ECDSA curves.” The seeds were public from day one, so there was never a secret to steal. The finding is about how the numbers were picked, not about cracking them.

Why this actually matters

So a model figured out that a 1990s number generator was seeded with the clock. Mundane, right? Actually, mundane is the best possible outcome for cryptography. The whole point of a seed is verifiable randomness: if you can show the parameters came from an unremarkable process anyone can rerun, there’s almost no room left to hide a backdoor. Anthropic’s claim is exactly that: reproducibility means “we can be confident the parameters are secure.”

But zoom out and the story gets stranger. For a quarter century, the best-funded cryptographers on earth stared at these numbers and couldn’t place them. A model, asked an open-ended question by an employee on a whim, needed 30 minutes, and briefly questioned whether the task was real because the answer came so fast. That’s a decent illustration of what AI does to research that humans assumed was hard: it doesn’t grind through more combinations, it notices the pattern a person would dismiss as too simple.

There’s a sharper lesson in the fine print, too. CoinDesk’s report flagged it: the same predictability that made the NSA’s seeds reproducible would be a disaster inside a crypto wallet. A private key generated with lrand48 could be recreated by anyone who guessed roughly when it was made, and the money would be gone. The NSA’s seeds were public, so nothing was ever at risk — but somewhere out there, old software is still doing exactly this with secrets.

Cryptographers got their answer, skeptics got their backdoor theory deflated, and Valsorda’s $36,864 went to the people who keep TLS working for the rest of us. Not bad for 30 minutes.

FAQ

What is the NIST crypto mystery that Claude solved?

For about 25 years, nobody knew where the NSA-supplied seed values behind the NIST elliptic curves came from. Claude traced five of them to lrand48, a 1990s C-library random-number generator seeded with Unix timestamps from 1997–1998.

Did Claude break the encryption on these curves?

No. Anthropic explicitly says this is not a cryptographic break or a new weakness. The seeds were always public. The finding only explains how they were generated, which removes the main reason to suspect a hidden NSA backdoor.

What exactly did Claude find for the P-256 seed?

The P-256 seed corresponds to candidate number 1,842 from a run of lrand48 seeded with Unix timestamp 871696354, which is August 16, 1997, at 01:52:34 UTC. Anyone can now rerun the program and reproduce the NSA’s number.

Is everything about the curves now explained?

Not quite. The B-163 binary-curve seed still doesn’t match anything Claude tried, and Anthropic says it doesn’t know how the base points for P-224, P-256, P-384 and P-521 were generated.

Sources: Anthropic research report (Oct 16, 2026); CoinDesk; Crypto Briefing; Cybersecurity News; Dealroom; AI Weekly.