For more than a quarter-century, cryptographers wondered whether a handful of unexplained numerical seeds supplied by the National Security Agency for the National Institute of Standards and Technology’s standardized elliptic curves might conceal a hidden weakness.
Those curves underpin the Elliptic Curve Digital Signature Algorithm (ECDSA), the dominant method for verifying the authenticity of websites, software, and digital transactions across the internet.
When NIST published the parameters in its 2000 Digital Signature Standard, the agency simply listed the seeds without describing how they had been chosen.
The absence of any justification fueled persistent speculation that the values might have been selected to enable a covert backdoor.
One widely circulated account, attributed to longtime NSA mathematician Jerry Solinas, held that the seeds were produced by hashing a lighthearted internal phrase—something along the lines of “Give Bob and Jerry a raise.”
Solinas himself could not recall the exact wording, and the colleague who had written the generation code also had no clear memory.
After Solinas’s death in 2023, the question remained open.
Independent researchers launched informal investigations, and cryptographer Filippo Valsorda offered a substantial public bounty for anyone who could reconstruct the original inputs.
In October 2026 an Anthropic employee posed the problem to an internal research version of Claude without mentioning the longstanding passphrase theory.
Within less than thirty minutes the model identified the true origin.
None of the five primary NIST prime-field seeds—those for the curves known as P-192, P-224, P-256, P-384, and P-521—were the output of any cryptographic hash.
Instead, they were consecutive blocks of bytes drawn from the ordinary linear-congruential generator lrand48, a routine component of 1990s C standard libraries, after the generator had been initialized with a Unix timestamp.
Claude reached this conclusion by examining statistical fingerprints in the published seeds. It noticed that several seeds displayed a distinctive pattern of zeroed high-order bits, a signature of lrand48’s truncated 31-bit output.
Recovering the generator’s hidden internal state required a standard lattice-reduction technique (the Lenstra–Lenstra–Lovász algorithm) applied to the truncated values.
Once the state was known, the generator could be run backward until it matched the form produced by a call to srand48.
Those starting values proved to be Unix timestamps falling between May 1997 and April 1998.
For the widely used P-256 curve, the published seed corresponded to the 1,842nd candidate generated from a run that began at 01:52:34 UTC on 16 August 1997.
Parallel analysis recovered the seeds of additional ANSI X9.62 example curves by the same method.
The model also located the source of certain base points that accompany the curves.
Base points for P-192 and five related ANSI curves matched a simple discard-and-sample procedure using the random-number generator in Arjen Lenstra’s FreeLIP arithmetic library, seeded with small integers such as 20,000.
Anthropic published short, reproducible code that regenerates all of the recovered seeds exactly, allowing independent verification.
The finding does not constitute a break of ECDSA, nor does it reveal any new attack.
On the contrary, the prosaic generation process—an everyday 1990s pseudorandom generator seeded from the system clock—makes an intentional search for weakened curves substantially less plausible.
Only a modest number of candidate seeds were skipped, far too few to suggest a systematic hunt for special weaknesses.
A few questions remain unresolved, including the origin of the binary-field seed B-163 and the precise selection method for several later base points, yet the principal mystery has been closed.
The $36,864 bounty associated with the seeds is being donated to the Internet Security Research Group, the nonprofit that operates Let’s Encrypt. Anthropic’s research post frames the episode as the end of long-running speculation rather than a cause for alarm: the parameters can now be reproduced by anyone, and no change in operational practice is required.
