Claude Solves 25-Year NIST Cryptography Mystery Using lrand48

Anthropic says its Claude AI model has solved a decades-old mystery surrounding the origins of the seed values used in five widely deployed NIST elliptic-curve cryptography standards. Published on October 16, 2026, the research explains that the seeds for NIST P-192, P-224, P-256, P-384 and P-521 can be traced to the output of a familiar C library random-number generator called lrand48, initialized using Unix timestamps. Anthropic said Claude identified the method in under half an hour after an employee asked the model to investigate the question without supplying the suspected answer.

The discovery addresses a long-standing concern in the cryptographic community: the original seed values had been supplied by the US National Security Agency (NSA) without a detailed public explanation of how they were generated. That lack of documentation fuelled speculation about whether the parameters could have been deliberately selected to weaken the resulting curves. Anthropic says the newly identified generation process makes deliberate backdoor concerns less plausible. The research does not identify a cryptographic break, and the company says existing users do not need to change their systems.

Key Takeaways

• Mystery addressed: Claude traced the seeds behind five NIST elliptic curves to the lrand48 pseudorandom-number generator.
• How it worked: The generator was initialized using Unix timestamps, producing candidate seed values.
• Time taken: Anthropic says Claude found the explanation in under 30 minutes.
• Standards involved: NIST P-192, P-224, P-256, P-384 and P-521.
• Security implications: Anthropic says the discovery is not a cryptographic break and does not require users to take action.
• Independent verification: Cryptographer Filippo Valsorda reportedly reproduced the result.
• Bounty: The $36,864 prize associated with the challenge will be donated to the Internet Security Research Group, which supports Let’s Encrypt.

What Was the 25-Year Cryptography Mystery?

Elliptic-curve cryptography is a widely used method for securing digital communications and verifying identities. It underpins digital signatures and other security mechanisms used in software, websites, devices and online services.

One important application is the Elliptic Curve Digital Signature Algorithm, or ECDSA. It allows systems to verify that a digital message or transaction was signed by the holder of a corresponding private key without revealing that key.

The security of an elliptic-curve system depends on mathematical parameters that define the curve and the operations performed on it. When standards organisations publish these parameters, researchers want to understand how they were selected, particularly when the choices affect the security of widely used infrastructure.

NIST adopted the relevant curves as part of its digital-signature standard in 2000. The published specifications included seed values associated with the construction of the curves. The NSA supplied those seeds, but the original documentation did not explain their provenance in sufficient detail to settle questions about the selection process.

That uncertainty became a recurring subject of cryptographic discussion. Researchers considered whether the seeds had been selected randomly or through a process that could have introduced an intentional weakness.

The absence of a documented explanation was not itself proof that the curves were compromised. However, it left a historical question unresolved for more than two decades.

How Claude Found the Origins of the NIST Curve Seeds

Anthropic says Claude approached the problem by examining how engineers might have generated the seeds using software available in the 1990s.

An earlier theory suggested that the values might have originated from a humorous phrase that had been hashed. Investigators had explored that possibility without finding a convincing explanation.

Claude took a different route. Rather than continuing to search for a phrase, it considered whether the seeds could have been produced by a conventional pseudorandom number generator.

The model wrote a scanner to examine the published seed values bit by bit. It tested whether adjacent sections of the data matched consecutive outputs from several older random-number generators. Anthropic says the search covered 34 combinations of generator and output slices.

The investigation identified a pattern in the upper bits of some seed values. That pattern was consistent with lrand48, a pseudorandom number generator found in traditional C library environments.

The generator produces values from an internal 48-bit state but returns only 31 bits per output. That structure leaves recognisable patterns in its output and can help investigators reconstruct the underlying state when enough information is available.

Claude then used the observed pattern to recover the generator state and test whether the resulting sequence reproduced the published seed values.

The recovered states led to Unix timestamps used to initialise the generator. Anthropic says the process explained the seeds behind the five NIST prime-field curves, providing a reproducible account of how the values could have been produced.

Why Unix timestamps mattered

A Unix timestamp represents a point in time as a numerical count of seconds from a defined starting date in 1970. Using a timestamp to initialise a pseudorandom number generator is a straightforward way to give a program an initial state that changes with time.

The method is not considered suitable for generating secret cryptographic keys because the possible initial states can be searched if an attacker knows or can estimate the relevant time window.

However, the historical use of a timestamp to generate public curve parameters is a different question from how a cryptographic system generates private keys today.

Anthropic’s finding concerns the origin of public seed values used in constructing standardised curves. It does not mean that the private keys generated by systems using those curves were derived from the same timestamp process.

That distinction is central to understanding why the discovery does not amount to a newly identified vulnerability.

Which NIST Curves Were Involved?

The investigation covered five widely recognised NIST elliptic curves.

Curve	General role
P-192	A legacy elliptic-curve parameter set
P-224	A standard curve with a 224-bit field
P-256	A widely used 256-bit elliptic curve
P-384	A 384-bit elliptic curve used where higher security margins are required
P-521	A 521-bit elliptic curve

The numbers in the curve names indicate the approximate bit size of the underlying prime field, with P-521 using a 521-bit field. Larger parameter sizes generally provide different security and performance characteristics, so systems select curves according to their requirements and supported standards.

P-256 is particularly important because it has been adopted widely across internet security, digital signatures and other cryptographic applications.

The discovery is therefore significant as a historical explanation of parameters used by real-world systems. It is not, however, evidence that every cryptographic standard or every elliptic curve has the same origin.

Does This Mean NIST Cryptography Was Backdoored?

Anthropic’s conclusion is that the discovery makes deliberate backdoor concerns less plausible. The seeds appear to have come from a conventional random-number generator initialised with timestamps, rather than from an unexplained custom construction.

A cryptographic backdoor would involve a deliberate weakness or mechanism that allows an unauthorised party to undermine security. Finding a reproducible process for generating public parameters does not, by itself, establish that such a mechanism existed.

The result also does not mean the original generation procedure was ideal by modern documentation standards. The lack of an explanation for the seed values created years of uncertainty, and a more transparent record would have made the process easier to evaluate.

Anthropic explicitly says the discovery is not a cryptographic break. It also states that users do not need to make changes to their systems as a result.

That assessment is consistent with the distinction between uncovering the provenance of public parameters and discovering a method to recover private keys, forge signatures or bypass cryptographic verification.

Nevertheless, the result should not be overstated. It addresses the origin of the seed values, while other questions about the original curve-generation process remain unresolved. The research makes a deliberate backdoor less plausible; it does not provide a complete explanation of every historical choice made during standardisation.

Why the Discovery Matters for AI-Assisted Security Research

The investigation is notable because it demonstrates how an AI model can contribute to a technical research problem that requires hypothesis formation, programming and mathematical reasoning.

Claude did not simply retrieve an existing explanation. According to Anthropic, it developed a different approach, wrote code to scan the seed values, identified a generator-specific pattern and used that pattern to recover the initial state.

This kind of work can be valuable in cybersecurity research, where investigators often need to connect incomplete historical evidence with the behaviour of old software and mathematical systems.

AI models can help researchers explore hypotheses, build test programs and analyse results. But the important part of the process is not merely generating a plausible explanation. The proposed method must reproduce the evidence, withstand scrutiny and be checked independently.

In this case, Anthropic published the methodology and reported that cryptographer Filippo Valsorda independently reproduced the result. Such verification helps distinguish a useful discovery from an unsupported claim produced by an AI system.

The result does not establish that AI can autonomously solve every cryptographic problem. It illustrates a more specific capability: using programming and mathematical analysis to investigate a narrow, well-defined technical mystery.

The $36,864 Bounty Will Support Internet Security

The research also closes a public challenge associated with the origins of the NIST elliptic-curve seeds.

Cryptographer Filippo Valsorda announced a bounty in 2023 to encourage investigation into how the seed values were generated. The challenge offered a cash prize, with the total increasing to $36,864 if the winner chose to direct the funds to charity.

Anthropic’s team claimed the prize after identifying the generation process. The company said the $36,864 would be donated to the Internet Security Research Group, the nonprofit organisation behind Let’s Encrypt.

Let’s Encrypt provides free digital certificates that help websites use HTTPS, the protocol that encrypts connections between browsers and websites. Its work supports a broader effort to make secure internet connections more accessible.

The donation gives the research a practical outcome beyond resolving a historical question. It also illustrates how public technical challenges can reward reproducible findings that improve understanding of important security infrastructure.

What Researchers Still Do Not Know

Although Anthropic says the seed origins have been identified, the work does not resolve every aspect of the original curve-generation process.

The fact that a particular generator and timestamp can reproduce a published seed does not necessarily explain why every candidate was accepted or rejected, how all related parameters were selected, or what undocumented criteria influenced the final choices.

Those questions matter when assessing historical cryptographic standards because reproducibility is only one part of the evidence. Researchers also need to understand the selection process and whether any choices could have introduced unintended or intentional weaknesses.

Anthropic’s result reduces uncertainty about the seed values. It does not eliminate the need for careful documentation, independent review or transparent standardisation practices.

The broader lesson is that cryptographic trust depends not only on the mathematics but also on how standards are generated, documented and evaluated.

The Bigger Picture

Claude’s discovery shows how AI-assisted research can help resolve difficult technical questions by combining code generation, pattern recognition and mathematical reasoning. The result provides a plausible and reproducible explanation for the origins of five important NIST curve seeds, replacing decades of speculation with a concrete mechanism.

At the same time, the findings demonstrate why technical claims need careful boundaries. The work is not a new cryptographic attack, does not show that modern private keys are compromised and does not require users to abandon the affected curves. Its significance lies in improving transparency around the historical construction of widely used security standards.

Looking Ahead

Researchers can now examine the published method and its results to understand how the lrand48 generator and Unix timestamps reproduce the seed values. The reported independent verification strengthens the case for the explanation, while remaining questions about the original selection process may warrant further historical investigation. For organisations using the affected curves, Anthropic says no immediate changes are necessary.

The broader implications extend to AI-assisted cybersecurity research. Models may become increasingly useful for investigating legacy code, testing mathematical hypotheses and reconstructing undocumented processes. Their findings will still need reproducible evidence and independent scrutiny, especially when they concern the security foundations of widely deployed systems.

Frequently Asked Questions

1. What did Claude discover about NIST’s elliptic curves?

Anthropic says Claude traced the seeds for NIST P-192, P-224, P-256, P-384 and P-521 to outputs from the lrand48 pseudorandom number generator initialised using Unix timestamps.

2. Why were the curve seeds controversial?

The NSA supplied the seed values used in the standards, but the original documentation did not adequately explain their origins. That lack of transparency led to speculation about whether the parameters might have been deliberately weakened.

3. Does the discovery mean ECDSA is unsafe?

No. Anthropic says the finding is not a cryptographic break and does not require users to take action. It explains the origins of public seed values rather than identifying a way to recover private keys or forge signatures.

4. How long did Claude take to solve the mystery?

Anthropic says the model identified the generation process in under half an hour.

5. What is lrand48?

lrand48 is a pseudorandom number generator historically available in C library environments. It produces values from an internal 48-bit state and returns 31-bit outputs. Anthropic says the historical seed values can be reproduced by initialising the generator with Unix timestamps.

6. What happened to the cryptography bounty?

The $36,864 prize associated with the challenge will be donated to the Internet Security Research Group, the nonprofit behind Let’s Encrypt.