Generated by Codex with GPT 5.6 Sol High

Techmeme surfaced Anthropic’s October 16 research note, “Claude reveals ECDSA curve origins”. The discovery does not crack elliptic-curve cryptography. It instead reconstructs how some of the world’s most familiar cryptographic parameters were generated in the late 1990s, replacing an unexplained choice by the NSA with a reproducible trail back to timestamps and an ordinary C library random-number generator.

Why unexplained seeds mattered

NIST standardized a family of elliptic curves in 2000 for use in digital signatures and other cryptographic systems. Each curve came with a published 160-bit “seed.” The standard hashes that seed and uses the result to derive part of the curve, which was meant to make the parameters look less arbitrary. But it never explained where the seed itself came from.

That omission left an uncomfortable gap. If the NSA could search many candidate seeds and reveal only one, it might in principle choose a curve with a hidden property known only to itself. No practical backdoor was found, and specialists generally continued to trust the curves after decades of analysis, but the opaque provenance sustained suspicion—especially after the separate Dual EC pseudorandom-generator scandal showed that standardized elliptic-curve parameters could be manipulated.

The surviving oral history pointed in the wrong direction. Jerry Solinas, an NSA cryptographer involved in the work, recalled that the seeds might have come from hashing a joke about colleagues. Human and automated searches for plausible phrases produced nothing. In October 2026, an Anthropic employee gave an internal Claude research model the open problem without that clue. Anthropic says the model found the core mechanism in under half an hour.

Reading a 1990s program from its output

Claude approached the seeds as traces of old software rather than hidden prose. It tested whether adjacent pieces resembled consecutive outputs from pseudorandom generators common in 1990s C environments. Four binary-curve seeds shared an unlikely bit pattern: when written as 32-bit words, their top bits were always zero. That is exactly the sort of fingerprint produced by lrand48, which exposes only 31 bits from a 48-bit internal state.

For those seeds, the model tried the 2¹⁷ possible hidden low bits of the first state and checked whether the following words matched. The prime-curve seeds retained even fewer bits, so the model used the standard Lenstra–Lenstra–Lovász lattice-reduction algorithm to recover the truncated generator state. It then ran the linear generator backward until the state had the form produced by srand48.

The recovered initial values were Unix timestamps. Ten prime-curve seeds map to dates between May 1997 and April 1998; four binary-curve values map to April 17, 1998 if the generating program halved the clock value. From those timestamps, iteration counts, and the published algorithm, Anthropic’s short reference implementation reproduces the standardized values exactly. P-256, for example, appears as the 1,842nd 20-byte candidate from a generator initialized at 01:52:34 UTC on August 16, 1997.

The investigation also traced the base points for P-192 and five ANSI example curves to the generator in Arjen Lenstra’s FreeLIP arithmetic package, initialized with small integer seeds. That second reconstruction is important because the published curve seed does not determine the base point used by ECDSA.

Strong evidence, with gaps still visible

Independent cryptographer Filippo Valsorda reimplemented the generation process in Go and accepted the bounty claim. Exact regeneration from a compact historical recipe is much stronger evidence than a plausible story: unrelated timestamps and iteration counts would not repeatedly yield the published 160-bit values by chance. The team donated the tripled \$36,864 bounty to the Internet Security Research Group, the nonprofit behind Let’s Encrypt.

The result narrows the backdoor story but does not turn every historical choice into a documented ceremony. Some candidate seeds would also have produced curves meeting the known criteria, yet the generating process skipped them. Anthropic and Valsorda found one additional rejection rule, but roughly twice as many candidates still qualify as were published. The researchers do not know whether another test, a software bug, or some other artifact explains the remaining gaps.

Several parameters also remain unresolved. The B-163 binary seed did not fit the recovered process. Nor did the team recover the base-point selection method for P-224, P-256, P-384, P-521, or the NIST binary curves. Anthropic argues that the small number of skipped viable curves makes deliberate selection of a weak one implausible, but the recovered numbers cannot reveal how many complete searches were attempted.

The useful role was search, not authority

The work is a good example of an AI system contributing through hypothesis generation, code writing, and rapid search over technical possibilities. The model noticed a statistical signature, connected it to historical software, applied a known lattice technique, and produced claims that humans could verify by exact computation. The result does not depend on trusting Claude’s prose or hidden reasoning; it depends on public parameters, executable code, and independently reproducible matches.

That distinction also sets the right limit. The discovery is not evidence that current cryptography has been broken, that ECDSA users need to change keys, or that an AI system proved the absence of a backdoor. It resolves much of a provenance mystery and makes malicious parameter selection substantially less plausible, while leaving specific selection decisions unexplained.

The broader lesson is institutional as much as technical. Cryptographic standards earn trust through transparent generation procedures, reproducible artifacts, and public review—not merely through years without a known attack. Claude helped recover that transparency after the fact. Future standards should preserve it from the start.