# Claude Cracked the NSA Curve Mystery > Source: > Published: 2026-10-17 18:51:36+00:00 ## The unexplained numbers behind HTTPS Elliptic-curve cryptography (ECC) underpins the secure connections browsers forge with websites, enabling the crucial exchange of a shared secret key in plain sight. This mathematical feat relies on **elliptic curves**, where specific operations are computationally trivial to perform, but practically impossible to reverse. The P-256 curve, a standard published by NIST in 2000, became a cornerstone of TLS 1.3 and HTTPS, mandated for virtually every application. For over two decades, cryptographers harbored a profound unease regarding these NIST curves. The parameters defining their shape incorporated arbitrary "seeds" provided by the **NSA**, with no public explanation for their genesis. This lack of transparency fueled speculation: could the NSA have deliberately chosen these seeds to embed a secret backdoor, allowing them unique access to encrypted communications? The infamous Snowden revelations concerning the **Dual_EC_DRBG** random number generator amplified these suspicions, showing a separate NSA-influenced standard was indeed compromised. However, it is critical to distinguish Dual_EC_DRBG from the NIST elliptic curves. While the prior incident made a conspiracy theory about P-256 understandable, it never constituted proof of a backdoor in the elliptic curves themselves. ## Claude ignored the famous clue—and found a timestamp For decades, a tantalizing rumor, attributed to NSA mathematician Jerry Solinas Solinas, suggested the P-256 seed originated from hashing a memorable phrase. This explanation, though never fully corroborated, steered researchers toward fruitless searches for the "joke phrase" Solinas mentioned, like "give Bob Reiter Reiter and Jerry Solinas Solinas a raise," which he couldn't recall before his passing in 2023. This led to a long-standing bounty for the solution, fueling speculation. [Claude](https://www.stork.ai/en/anthropic-workbench), however, ignored this famous clue. Instead of chasing a forgotten phrase, the Anthropic model explored common pseudorandom number generator (PRNG) patterns. It identified statistical artifacts, such as a consistently zeroed top bit, characteristic of specific legacy generators. Using lattice reduction algorithms, Claude worked backward from these "fingerprints" to reconstruct the generator's internal state. The key result: the seeds for several NIST prime curves, including P-256, matched outputs from `lrand48`. This familiar Unix-era C-library generator, widely used in the 1990s, was initialized from simple Unix timestamps. For P-256 specifically, the reconstruction points to `lrand48` being seeded on **August 16, 1997, at 01:52:34 UTC**, with the official P-256 seed corresponding to its **1,842nd** generated number. Other NIST curves, like P-192, also aligned with `lrand48` outputs from timestamps across May 1997 to April 1998. ## The math behind the fast forensic breakthrough Claude's breakthrough hinged on recognizing subtle statistical "fingerprints" within the seed values. It identified that the NIST-provided seeds exhibited characteristics consistent with `lrand48`, a common pseudorandom number generator (PRNG) from 1990s C libraries. Specifically, Claude noted constrained top-bit behavior in the generated outputs. From these truncated outputs, Claude ingeniously reconstructed the PRNG's internal state. It employed **lattice-reduction methods**—a sophisticated technique for finding short vectors in high-dimensional lattices—to reverse-engineer the generator's state, even with incomplete information. This allowed it to trace the random numbers back to their initial conditions. The speed of this reconstruction was remarkable: under half an hour for five NIST curves. Claude’s internal scratchpad even showed it expressing surprise, questioning whether it was in a simulated test environment given the rapid success. For **P-256**, the generator started on August 16, 1997, at 01:52:34 UTC, and the official seed was the 1,842nd number it produced. Anthropic rigorously verified these findings, publishing reproducible code that allowed independent researchers to regenerate the reported seeds character-for-character within seconds. This process also resolved the origins of several ANSI X9.62 and NIST base points, linking them to Arjen Lenstra’s FreeLIP library. Anthropic claimed a long-standing $36,864 bounty for this discovery and donated it to the Internet Security Research Group (ISRG). Further details, including the research paper, are available at [Anthropic Research: ECDSA Curve Origins](https://www.anthropic.com/research/ecdsa-curve-origins). Enjoying this? Get one like it in your inbox each morning. one email a day · unsubscribe in two clicks · no third-party tracking ## A reassuring answer, with loose ends Unveiling the timestamp origins offers significant reassurance, not a cryptographic crisis. A Unix timestamp, providing roughly 30 bits of choice, presents a drastically smaller search space than a deliberately engineered backdoor would require. This limited freedom means a concealed weakness is highly improbable. Crucially, this discovery does not break **TLS**, reveal private keys, or forge signatures. P-256 remains secure, requiring no urgent patch or protocol overhaul. Anthropic’s analysis, and subsequent independent verification, confirmed the curves are cleaner, not weaker. Lingering questions remain, however. The B-163 binary curve’s seed, for instance, still lacks a full explanation. The precise origins of certain **base points** — the initial coordinates on the elliptic curve — also await complete elucidation, though some have been linked to Arjen Lenstra’s FreeLIP library. Furthermore, cryptographers still ponder why one qualifying P-256 candidate was selected over others that also met the criteria. While Claude’s work dramatically reduced suspicion surrounding the NIST curves, it provides a crucial chapter in their history, not a definitive account of every design choice. ## Frequently Asked Questions ### What did Claude discover about the NIST curve seeds? Anthropic’s Claude traced several NIST curve seeds to outputs from the lrand48 pseudorandom number generator, initialized with Unix timestamps. ### Does the discovery mean P-256 was backdoored? No. The timestamp-based process leaves too little freedom to make an intentional backdoor plausible, and the finding does not enable attacks on P-256. ### How did Claude reconstruct the seeds? It recognized statistical patterns in lrand48 outputs and used mathematical techniques, including lattice reduction, to recover likely generator states. ### Are all the curve origins now explained? No. Some seed origins and base-point choices remain unresolved, including the B-163 binary curve seed and the selection of a P-256 candidate.