{"slug": "claude-cracked-the-nsa-curve-mystery", "title": "Claude Cracked the NSA Curve Mystery", "summary": "Anthropic's Claude reconstructed the origin of the NIST P-256 elliptic-curve seed, showing it matches output from the Unix-era lrand48 pseudorandom number generator seeded on August 16, 1997, at 01:52:34 UTC, with the official seed corresponding to the generator's 1,842nd number. Using lattice-reduction methods on statistical artifacts such as a consistently zeroed top bit, Claude traced seeds for several NIST prime curves, including P-192, to lrand48 timestamps spanning May 1997 to April 1998, completing five curves in under half an hour. The finding offers a mundane explanation for parameters the NSA supplied without public justification, defusing two decades of speculation that the seeds concealed a backdoor, though it does not by itself prove the curves are secure.", "body_md": "## The unexplained numbers behind HTTPS\n\nElliptic-curve cryptography (ECC) underpins the secure connections browsers forge with websites, enabling the crucial exchange of a shared secret key in plain sight. This mathematical feat relies on **elliptic curves**, where specific operations are computationally trivial to perform, but practically impossible to reverse. The P-256 curve, a standard published by NIST in 2000, became a cornerstone of TLS 1.3 and HTTPS, mandated for virtually every application.\n\nFor over two decades, cryptographers harbored a profound unease regarding these NIST curves. The parameters defining their shape incorporated arbitrary \"seeds\" provided by the **NSA**, with no public explanation for their genesis. This lack of transparency fueled speculation: could the NSA have deliberately chosen these seeds to embed a secret backdoor, allowing them unique access to encrypted communications?\n\nThe infamous Snowden revelations concerning the **Dual_EC_DRBG** random number generator amplified these suspicions, showing a separate NSA-influenced standard was indeed compromised. However, it is critical to distinguish Dual_EC_DRBG from the NIST elliptic curves. While the prior incident made a conspiracy theory about P-256 understandable, it never constituted proof of a backdoor in the elliptic curves themselves.\n\n## Claude ignored the famous clue—and found a timestamp\n\nFor decades, a tantalizing rumor, attributed to NSA mathematician Jerry Solinas Solinas, suggested the P-256 seed originated from hashing a memorable phrase. This explanation, though never fully corroborated, steered researchers toward fruitless searches for the \"joke phrase\" Solinas mentioned, like \"give Bob Reiter Reiter and Jerry Solinas Solinas a raise,\" which he couldn't recall before his passing in 2023. This led to a long-standing bounty for the solution, fueling speculation.\n\n[Claude](https://www.stork.ai/en/anthropic-workbench), however, ignored this famous clue. Instead of chasing a forgotten phrase, the Anthropic model explored common pseudorandom number generator (PRNG) patterns. It identified statistical artifacts, such as a consistently zeroed top bit, characteristic of specific legacy generators. Using lattice reduction algorithms, Claude worked backward from these \"fingerprints\" to reconstruct the generator's internal state.\n\nThe key result: the seeds for several NIST prime curves, including P-256, matched outputs from `lrand48`. This familiar Unix-era C-library generator, widely used in the 1990s, was initialized from simple Unix timestamps. For P-256 specifically, the reconstruction points to `lrand48` being seeded on **August 16, 1997, at 01:52:34 UTC**, with the official P-256 seed corresponding to its **1,842nd** generated number. Other NIST curves, like P-192, also aligned with `lrand48` outputs from timestamps across May 1997 to April 1998.\n\n## The math behind the fast forensic breakthrough\n\nClaude's breakthrough hinged on recognizing subtle statistical \"fingerprints\" within the seed values. It identified that the NIST-provided seeds exhibited characteristics consistent with `lrand48`, a common pseudorandom number generator (PRNG) from 1990s C libraries. Specifically, Claude noted constrained top-bit behavior in the generated outputs.\n\nFrom these truncated outputs, Claude ingeniously reconstructed the PRNG's internal state. It employed **lattice-reduction methods**—a sophisticated technique for finding short vectors in high-dimensional lattices—to reverse-engineer the generator's state, even with incomplete information. This allowed it to trace the random numbers back to their initial conditions.\n\nThe speed of this reconstruction was remarkable: under half an hour for five NIST curves. Claude’s internal scratchpad even showed it expressing surprise, questioning whether it was in a simulated test environment given the rapid success. For **P-256**, the generator started on August 16, 1997, at 01:52:34 UTC, and the official seed was the 1,842nd number it produced.\n\nAnthropic rigorously verified these findings, publishing reproducible code that allowed independent researchers to regenerate the reported seeds character-for-character within seconds. This process also resolved the origins of several ANSI X9.62 and NIST base points, linking them to Arjen Lenstra’s FreeLIP library. Anthropic claimed a long-standing $36,864 bounty for this discovery and donated it to the Internet Security Research Group (ISRG). Further details, including the research paper, are available at [Anthropic Research: ECDSA Curve Origins](https://www.anthropic.com/research/ecdsa-curve-origins).\n\nEnjoying this? Get one like it in your inbox each morning.\n\none email a day · unsubscribe in two clicks · no third-party tracking\n\n## A reassuring answer, with loose ends\n\nUnveiling the timestamp origins offers significant reassurance, not a cryptographic crisis. A Unix timestamp, providing roughly 30 bits of choice, presents a drastically smaller search space than a deliberately engineered backdoor would require. This limited freedom means a concealed weakness is highly improbable.\n\nCrucially, this discovery does not break **TLS**, reveal private keys, or forge signatures. P-256 remains secure, requiring no urgent patch or protocol overhaul. Anthropic’s analysis, and subsequent independent verification, confirmed the curves are cleaner, not weaker.\n\nLingering questions remain, however. The B-163 binary curve’s seed, for instance, still lacks a full explanation. The precise origins of certain **base points** — the initial coordinates on the elliptic curve — also await complete elucidation, though some have been linked to Arjen Lenstra’s FreeLIP library.\n\nFurthermore, cryptographers still ponder why one qualifying P-256 candidate was selected over others that also met the criteria. While Claude’s work dramatically reduced suspicion surrounding the NIST curves, it provides a crucial chapter in their history, not a definitive account of every design choice.\n\n## Frequently Asked Questions\n\n### What did Claude discover about the NIST curve seeds?\n\nAnthropic’s Claude traced several NIST curve seeds to outputs from the lrand48 pseudorandom number generator, initialized with Unix timestamps.\n\n### Does the discovery mean P-256 was backdoored?\n\nNo. The timestamp-based process leaves too little freedom to make an intentional backdoor plausible, and the finding does not enable attacks on P-256.\n\n### How did Claude reconstruct the seeds?\n\nIt recognized statistical patterns in lrand48 outputs and used mathematical techniques, including lattice reduction, to recover likely generator states.\n\n### Are all the curve origins now explained?\n\nNo. Some seed origins and base-point choices remain unresolved, including the B-163 binary curve seed and the selection of a P-256 candidate.", "url": "https://wpnews.pro/news/claude-cracked-the-nsa-curve-mystery", "canonical_source": "https://www.stork.ai/blog/claude-cracked-the-nsa-curve-mystery", "published_at": "2026-10-17 18:51:36+00:00", "updated_at": "2026-10-17 19:37:40.085848+00:00", "lang": "en", "topics": ["artificial-intelligence", "ai-research", "large-language-models"], "entities": ["Anthropic", "Claude", "NSA", "NIST", "P-256", "P-192", "lrand48", "Jerry Solinas"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/claude-cracked-the-nsa-curve-mystery", "markdown": "https://wpnews.pro/news/claude-cracked-the-nsa-curve-mystery.md", "text": "https://wpnews.pro/news/claude-cracked-the-nsa-curve-mystery.txt", "jsonld": "https://wpnews.pro/news/claude-cracked-the-nsa-curve-mystery.jsonld"}}