Claude Traces NIST ECDSA Curve Seeds to Unix Timestamps and lrand48

An Anthropic red-team model resolved the 25-year-old question of how the NSA-generated seeds behind the NIST elliptic curves were made, finding they came from an old C library RNG seeded with timestamps. — Generated via ComfyUI / Z-Image Turbo

The seeds and the silence

NIST adopted ECDSA in 2000 as part of the FIPS 186-2 Digital Signature Standard, which listed standard elliptic curves at several sizes and security levels. For curves over prime and binary fields, the specification published a seed parameter whose hash value is used to define the coefficient b of the curve. The seeds behind P-192, P-224, P-256, P-384 and P-521 were supplied by the NSA with no explanation or justification attached.

That silence carried weight. A seed whose derivation is unknown cannot be shown to have been generated honestly, so the possibility that a curve was selected after testing many candidates until one proved weak stayed live for twenty-five years. The question attracted a bounty and amateur sleuthing efforts. Jerry Solinas, a late NSA employee, suggested the seeds were hashes of humorous phrases; that turned out to be wrong.

The answer arrived on 16 October 2026, when Anthropic published a report from its Frontier Red Team describing how an internal Claude research model traced all five seeds in under 30 minutes. The values, the report concluded, came from lrand48, an older C library random-number generator initialized with Unix timestamps. Anthropic opened its write-up with a four-word verdict: it's just timestamps.

What lrand48 rules out

lrand48 is an older random-number function from the C standard library, and a Unix timestamp counts seconds elapsed since 1970. Neither carries any cryptographic intent. That suggests the seeds were produced by a routine script run at a particular moment on a Unix machine, recorded and pasted into the standard, rather than by a deliberate process designed to demonstrate that the curves were chosen honestly.

What the finding rules out is the backdoor hypothesis in its strongest form. A seed fixed by a clock through lrand48 leaves no room for generating many candidate curves and keeping the one that hides a weakness, because the input value was determined before any curve arithmetic began. It also ends the humorous-phrase theory, which the-decoder.com reports turned out to be wrong.

The result also constrains the timeline. A Unix timestamp encodes the second of generation, so each of the five seeds was created at an identifiable moment, presumably during the standards work that preceded FIPS 186-2. The material summarized here does not state those timestamps, so the exact dates remain unstated; the open question is whether they align with the documented drafting period.

What changes for ECDSA users

Nothing operational changes. Anthropic states that readers should take this as a fun closing chapter and the end of years of speculation, with no action to take and nothing to do differently. Most researchers trusted the curves already. The finding explains how public parameters were chosen; it does not expose secret keys, break encryption, or alter the security properties of any signature produced under the standard.

The distinction worth keeping is between provenance and strength. Digital signatures under ECDSA verify who signed data and whether it has changed; that function is untouched by knowing where the seeds came from, and the curve parameters themselves are unchanged. What improves is auditability: a generation method this ordinary can be reproduced and checked by anyone, which is the property the missing NSA explanation had denied the standard for a quarter century.

The residual interest is methodological. A red-team model resolved in under half an hour a question that resisted a bounty and years of amateur sleuthing. That suggests structured search over published standards text plus verification of candidate derivations is now within reach of frontier models. Whether that capability generalizes beyond one well-documented historical puzzle remains untested, and no second case exists yet to check it against.

Claude Traces NIST ECDSA Curve Seeds to Unix Timestamps and lrand48

The seeds and the silence

What lrand48 rules out

What changes for ECDSA users

Sources