A puzzle that sat unsolved in cryptography for a quarter century took Claude less than 30 minutes. According to The Decoder, Anthropic’s model worked out how the NSA produced the mysterious seed values behind several elliptic curves that NIST standardized in 2000. The answer is far less sinister than many people feared.
🔐 The Mystery
In 2000, NIST added a set of elliptic curves to ECDSA, the most widely used standard for elliptic-curve digital signatures. These curves now sit under a huge share of the internet’s secure connections, software signing and identity systems.
The curve parameters came from “seeds,” the starting values fed into a generation process. The NSA supplied those seeds and never explained where they came from. That gap mattered. If you can’t see how the inputs were chosen, you can’t rule out that someone picked them to plant a weakness.
The suspicion got stronger after the Dual_EC_DRBG scandal, when an NSA-backed random number generator was widely believed to hide a backdoor. The Decoder notes that the seed question even drew a bounty and plenty of amateur sleuthing. The late NSA employee Jerry Solinas had suggested the seeds were a hash of a humorous phrase. That turned out to be wrong.
🧩 What Claude Found
Claude found that the seeds came from lrand48, a basic random number generator in the C standard library. The generator was initialized with a Unix timestamp from somewhere between May 1997 and April 1998.
The clue was in the bits. Here’s the reasoning, step by step:
- lrand48 only outputs 31 bits per call, not a full 32.
- So the top bit of each chunk is always zero. If you build a seed by joining those outputs together, you get zeros at regular spots.
- Some of the NSA seeds showed exactly that pattern, with top bits that were zero far too often to be chance.
- Once the generator was known, the timestamp range narrowed the possible starting values to something you could actually search.
It’s a classic forensic move: look for the fingerprint a tool leaves behind, then work backward to the tool. What stands out here is the speed. A human expert could have spotted this. None did for 25 years.
📊 Quick Facts
- Curves standardized: 2000 (NIST, ECDSA)
- Time the mystery stayed open: about 25 years
- Time Claude needed: under 30 minutes
- Seed source: lrand48, seeded with a Unix timestamp
- Timestamp window: May 1997 to April 1998
- Bounty: $36,864, which Anthropic is donating to the Internet Security Research Group, the nonprofit behind Let’s Encrypt
⚖️ Why It Matters
Anthropic says the finding makes a deliberate backdoor less likely. That’s the key word: less likely, not impossible. Still, a seed made from an off-the-shelf random function and a clock reading looks like an engineer grabbing whatever was handy in the late 1990s. It doesn’t look like a carefully built trap.
For security teams, there’s no action to take on the curves themselves. If you rely on these NIST curves today, this news should lower your worry, not raise it. It doesn’t change the math behind them.
The bigger takeaway is about method. This is a strong example of AI acting as a pattern detector on old, poorly documented artifacts. Practitioners can use the same approach today:
- Audit legacy constants. Ask a model to look for statistical oddities in magic numbers, keys and seeds in older code and standards.
- Check bit-level patterns. Generator quirks like lrand48’s 31-bit output leave traces that are easy to miss by eye.
- Document your own seeds. If you design a protocol, publish exactly how its constants were made. Nobody should need an AI to reverse-engineer them 25 years later.
🚧 Caveats
The report is short on details about how Anthropic set up the task, so it’s hard to say how much was the model’s own insight versus guided prompting. The result also explains how the seeds were made, not why the NSA chose that process or whether it tried several seeds before picking these. Independent cryptographers will want to reproduce the full chain, from timestamp to seed to curve, before calling the case fully closed.
Even so, the result shows that AI is starting to settle real open questions, not just benchmark puzzles. Expect more teams to point these models at the security world’s unexplained leftovers. The full story is available at The Decoder.