The Claude spark symbol. Image: Anthropic
For a quarter of a century nobody outside the NSA could say where the numbers behind some of the world’s most widely used encryption curves came from. Anthropic says Claude worked it out in under half an hour: they were not secret hashes at all, but the output of an ordinary 1990s random number generator started from the computer’s clock. The finding covers the seeds for NIST’s P-192, P-224, P-256, P-384 and P-521 curves, used by ECDSA, the elliptic curve signature standard NIST adopted in 2000. P-256 in particular sits underneath a large share of the web’s encrypted connections and digital signatures.
A seed with no explanation #
Each of the curves was built by hashing a published 20-byte “seed”. The NSA supplied those seeds with no word on how they were chosen, which left cryptographers wondering whether they had been picked to hide a weakness. P-256’s seed is C49D3608 86E70493 6A6678E1 139D26B7 819F7E90.
The best lead came from Jerry Solinas, the NSA mathematician behind the curves, who said in 2015 that they were hashes of a joke phrase. Anthropic quotes him:
The message was along the lines of ‘Give Bob and Jerry a raise’ or ‘Bob and Jerry rule’ or something like that. It was Bob Reiter who actually wrote the code, and he doesn’t remember the details either.
Jerry Solinas, NSA mathematician, 2015
Solinas died in 2023. Later that year the cryptographer Filippo Valsorda announced a bounty of $12,288 for cracking the seeds, tripled to $36,864 if the winner gave it to charity. Anthropic says several of its own staff had chased the joke-phrase tip without luck.
How Claude found it #
In October, an Anthropic employee asked an internal research model to work out how the seeds were made, without pointing it at the passphrase clue. Instead of guessing phrases, Claude reasoned that the software behind the curves probably used a weak random number generator of the kind that shipped with 1990s C libraries, whose output can be recognised.
It wrote a scanner to test whether chunks of each seed looked like consecutive outputs of such a generator. Four of the ten seeds it looked at had every top bit set to zero, a pattern Anthropic puts at a 1 in 5,810 chance. That pointed to lrand48, a standard C generator. Claude then recovered the generator’s internal state with a textbook lattice technique and ran it backwards to its starting point.
Every prime-curve seed traced back to a Unix timestamp between May 1997 and April 1998. P-256, Anthropic says, came from a run started at 01:52:34 UTC on 16 August 1997, and was the 1,842nd 20-byte candidate that run produced. Claude’s own reasoning at the time, published by Anthropic, reads: “This is astonishing: it solves the 25-year-old mystery. Hmm wait. Let me be skeptical.”
It also explained, for the first time as far as Anthropic knows, where the base points of P-192 and five related ANSI X9.62 curves came from.
Good news for the curves, with loose ends #
Anthropic stresses this is not a break of ECDSA. It argues the opposite: a clock-seeded generator that anyone can now rerun leaves little room for a hidden backdoor, and it says readers have nothing to change.
Some questions remain. For P-256, candidate 876 from the same run would also have produced a usable curve but was skipped, and Anthropic says it does not know why; it calls deliberately chosen weak curves implausible given how few were passed over. The seed for the binary curve B-163 and the base points for P-224, P-256, P-384 and P-521 are still unexplained.
The results are Anthropic’s own and have not yet been independently confirmed, though it has published code that regenerates every seed. It says the $36,864 bounty will go to the Internet Security Research Group, the non-profit behind Let’s Encrypt. The work follows other Claude security findings Anthropic has put out lately, from open models that can build hacks to a programme letting vetted red teams use Claude for offensive work.
Why it matters #
A puzzle that beat cryptographers and a public bounty for years fell to an AI model in about 30 minutes, and the answer is reproducible by anyone. It also takes much of the air out of one of cryptography’s longest-running backdoor suspicions.
Sources: Anthropic; Filippo Valsorda; NIST FIPS 186-2.