Seeds supplied by the NSA for elliptic-curve standards had gone unexplained for years, prompting suspicion about how the values were chosen. Anthropic says its AI Claude found a pattern linking them to a simple random number generator and a span of Unix timestamps, solving the puzzle in under 30 minutes.
Why the unexplained seeds raised questions
NIST standardized several curves in the ECDSA standard in 2000. ECDSA is described as the most widely used framework for elliptic-curve digital signatures. To generate the curve parameters, the process used seeds supplied by the NSA.
The seeds were starting values, but the source account says no explanation accompanied them. Without knowing how they were generated, observers could not rule out the possibility that the choices had been made to introduce a backdoor. The lack of an account left room for suspicion, even though the mystery itself did not prove that a backdoor existed.
The unanswered question drew a bounty and amateur sleuthing efforts. The late NSA employee Jerry Solinas had proposed that the seeds were hashes of a humorous phrase, but that idea turned out to be wrong. The gap between a plausible guess and an explanation was the core of the puzzle: what process had actually produced the values?
A pattern in the seed values
Claude’s reported answer points to “lrand48,” a simple C random number generator. The seeds were generated by initializing it with a Unix timestamp between May 1997 and April 1998.
The clue was a limitation in the generator’s output. “lrand48” produces only 31 bits, and the top bits in some of the seeds were systematically zero. That regularity gave Claude a way to connect the seed values to the generator rather than treating them as unexplained numbers.
This is a proposed origin story for the seeds, not a change to what the standards do. The account describes how the values were created; it does not say that the elliptic-curve parameters or ECDSA framework have been replaced.
What the explanation changes
An unexplained choice can be difficult to assess because people cannot inspect the reasoning behind it. A reproducible-seeming mechanism offers a concrete explanation to examine: in this case, a named random number generator and a timestamp range. Anthropic says the result makes deliberate backdoors less likely.
That conclusion is carefully limited. The account does not say the possibility of a backdoor has been disproved, nor does it provide further technical verification details. It reports that Claude identified the pattern and attributes the reduced likelihood of deliberate backdoors to Anthropic.
The episode also shows how a small structural clue can matter in a long-running technical mystery. If some values share a pattern that follows from a generator’s output limit, that pattern can narrow the search for how the values were made. Here, the significant observation was not a new standard, but the systematically zero top bits in some seeds.
The bounty goes to security research
Anthropic is donating the $36,864 bounty to the Internet Security Research Group. The payment connects the effort to the group that will receive the funds, while the discovery supplies an explanation for the origins of the seeds.
For readers trying to understand the significance, the distinction is straightforward: the mystery concerned how the NSA-supplied starting values were generated, and Claude’s answer identifies “lrand48” and a timestamp window. According to Anthropic, that account makes intentional tampering less likely, while leaving the original standards and their role in digital signatures as described in the source.