For years, the five NIST elliptic curves P-192, P-224, P-256, P-384, and P-521 carried a quiet question. The curves protect websites, payments, and government traffic, but their 160-bit seeds came from the National Security Agency, and no public explanation showed how those seeds were chosen. Cryptographers could check the math that turned each seed into a curve. They could not check the seed itself. That gap fed suspicion, including the idea that the NSA had picked values to hide a weakness.
The Old Explanation Did Not Hold Up
NSA mathematician Jerry Solinas was often linked to the seeds. The story went that they came from hashing humorous phrases, perhaps something like Jerry deserves a raise. But nobody remembered the exact wording, and the original machine was said to be gone. Solinas tried to rebuild the process and failed. In 2015, Neal Koblitz and Alfred Menezes examined the issue in a paper. They found no practical backdoor, yet the question stayed open. In October 2023, Filippo Valsorda offered $12,288 for a solid answer. Matching funds pushed the bounty to $36,864. Three years passed without a claimant.
Claude Finds a Unix Trail
Anthropic said on Oct. 16 that an employee asked an internal Claude research model to study the seeds without being told the old phrase theory. The model noticed something odd. Several seeds had groups of numbers with leading zero bits, a pattern with about a 1-in-5,810 chance if the values were random. That pointed to lrand48, an ordinary pseudorandom generator from Unix-era systems. Claude worked backward, recovered internal states, and reproduced the published seeds exactly. The states mapped to Unix timestamps from 1997 and 1998. P-192 traced to May 18, 1997; P-521 to Aug. 8; P-256 to Aug. 16; P-384 to Aug. 30; and P-224 to April 3, 1998. For P-256, the accepted seed appeared at candidate 1,842. For P-224, it took 7,026 tries. The run took less than 30 minutes.
Security Meaning and Pushback
Valsorda reproduced the result in Go, and Anthropic released code for others to check. The finding weakens one specific backdoor theory. The recovered method appears to leave about 30 bits of selection freedom, under generous assumptions, versus roughly 70 bits needed for one proposed attack. That is not proof of universal safety, and it does not break elliptic curve cryptography. It also does not touch Bitcoin or Ethereum, which use secp256k1. Bitcoin developer Gregory Maxwell offered a skeptical note on Hacker News. He said he had suggested the same problem to a friend whose AI agent spent hours without success. He wondered whether Anthropic had limited that model. He did not dispute the math. The $36,864 bounty went to the Internet Security Research Group, which runs Let’s Encrypt. Some details remain open, including why certain candidates were rejected and the origin of the B-163 seed. Still, the main answer looks plain: the seeds may have been keeping time.
The post Claude AI Traces NSA Crypto Seeds to 1990s Unix Timestamps appeared first on TheCryptoUpdates .
