Which RNG generated NIST curve seeds, prompting Anthropic to donate its bounty?

Anthropic’s Claude AI model solved a cryptography puzzle that had persisted for roughly 25 years by identifying the origin of five NSA-supplied elliptic curve seeds. The finding reveals that the starting values used to generate standard digital signature curves came from a simple C random number generator, rather than a hidden backdoor or a hash of humorous phrases as previously theorized.

What did the AI actually discover?

The internal Claude research model determined that the seeds for NIST curves P-192, P-224, P-256, P-384 and P-521 originated from lrand48. This older C library random-number generator was initialized with Unix timestamps falling between May 1997 and April 1998. According to Cyber Security News, this explanation clarifies how public security parameters were chosen without exposing secret keys or breaking existing encryption standards.

How did the model find the pattern?

Claude examined generators common in 1990s software and built a scanner covering 34 combinations of generators and output slices. It spotted that binary-curve seeds consistently had a zero in the highest bit, matching lrand48’s 31-bit output from a 48-bit internal state. For prime-curve seeds that retained only eight bits, the model used the Lenstra–Lenstra–Lovász lattice reduction algorithm to recover internal states, matching five NIST seeds and five ANSI X9.62 example seeds.

Why does this matter to developers?

NIST adopted the Elliptic Curve Digital Signature Algorithm in its FIPS 186-2 standard in 2000, but the NSA provided the seeds with zero explanation. That missing history fueled suspicion of possible backdoors, attracting a bounty and amateur sleuthing efforts. According to Anthropic, confirming the seeds came from a standard generator makes deliberate backdoors far less likely. This reassurance supports trust in widely used services like Apple’s PQ3 iMessage protocol, which uses ECDSA with P-256.

What happens to the bounty?

The mystery had attracted a bounty of $36,864 for solving the origin of the seeds. According to The Decoder, Anthropic is donating the full amount to the Internet Security Research Group. This donation follows the successful identification of the seeds by the Claude model, which completed the analysis in under 30 minutes, challenging earlier theories such as the one proposed by late NSA employee Jerry Solinas regarding humorous phrases.

What analysts watch for

Security teams usually examine cryptographic parameter origins when assessing trust in legacy standards. Analysts check whether curve seeds or constants have documented generation methods or appear derived from standard library functions. They review historical context to rule out arbitrary or opaque selection processes. Teams also monitor for new research that might reveal weaknesses in widely deployed algorithms. Understanding the provenance of public parameters helps verify that no hidden biases or weaknesses were introduced during standardization.

What to do and how to stay safe: Anthropic

• Review documentation for any cryptographic libraries in your stack to ensure they use standard, well-documented curve parameters.
• Monitor security advisories from standards bodies like NIST for updates on algorithm recommendations or deprecations.
• Verify that your software implementations of digital signatures rely on widely accepted standards rather than custom or undocumented parameters.
• Stay informed about research into cryptographic foundations, as new findings can impact trust in long-standing protocols.

Step-by-step guide: Build an Incident Response Plan That Actually Works

General security guidance from the Sandbox Dispatch newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Did the AI break the encryption?

No, the finding explains how public security parameters were chosen, rather than exposing secret keys or breaking encryption, according to Cyber Security News.

Which curves were affected?

The seeds behind NIST curves P-192, P-224, P-256, P-384 and P-521 were traced to the lrand48 generator.

How long did it take to solve?

Anthropic’s Claude model solved the mystery in under 30 minutes, according to The Decoder.