Image: Anthropic
For more than 25 years, a handful of numbers that help secure the internet came with no explanation, and plenty of suspicion. Anthropic now says Claude has worked out where they came from. The answer is almost comically dull: a computer's clock.
In a research post, Anthropic says an internal research model took under half an hour to trace the "seeds" behind five NIST elliptic curves: P-192, P-224, P-256, P-384 and P-521. None came from a secret phrase. According to Anthropic, they came from lrand48, an ordinary random number generator in 1990s C software, started with Unix timestamps from 1997 and 1998.
Some quick background. Elliptic curve cryptography uses maths on special curves to create digital signatures, which prove that a website or file really comes from who it claims. ECDSA is the most widely used standard for this. P-256 and P-384 are the curves behind the ECDSA certificates that "secure much of the web," as cryptographer Filippo Valsorda puts it. So the padlock in your browser often relies on them.
Bitcoin also uses ECDSA, but on a different curve, secp256k1, whose constants were picked in a predictable way. It isn't part of this story.
NIST published the P-curves in 2000. Each one was built by scrambling a seed, but the NSA supplied the seeds without saying where they came from. Longtime NSA employee Jerry Solinas later said he had hashed a joke phrase, something like "Bob and Jerry rule," and forgotten it. He died in 2023.
That gap mattered because of Dual_EC_DRBG. In 2013, Snowden documents suggested the NSA had pushed a flawed random number generator with a built-in "back door," and Reuters reported that RSA had been paid $10 million to make it the default in its software. RSA denied ever trying to weaken its products. NIST dropped the algorithm in 2014.
Most researchers already trusted the P-curves, Anthropic notes. Mathematicians Neal Koblitz and Alfred Menezes weighed the theories in "A Riddle Wrapped in an Enigma". But doubts lingered, and in 2023 Valsorda launched a bounty of $12,288 for the seeds' origins, tripled to $36,864 if donated to charity.
CLAUDE FOUND THE SEEDS
— Steve Weis (@sweis) October 16, 2026
https://t.co/m8N6OPQoCQ
Anthropic staff had chased the joke-phrase clue and come up empty. Asked without that hint, Claude guessed the software used a weak, old generator that leaves fingerprints. It spotted a pattern that would turn up by chance about once in 5,810 tries, recovered the generator's internal state, then ran it backwards to its starting value. Those values decoded as timestamps. P-256's seed was the 1,842nd candidate from a run started in August 1997.
Image: Anthropic
The best part is that anyone can check it. We ran the short Python script Anthropic published, and it regenerated all five seeds, character for character matching those on Valsorda's bounty list. Nobody had to take the NSA's word, or Anthropic's.
Anthropic is clear that this isn't a break or a new attack. It says the finding makes a deliberate backdoor "much less plausible" and that nobody needs to do anything. It also traced the base points of P-192 and five related ANSI curves to an old maths library by cryptographer Arjen Lenstra. The bounty money will go to the Internet Security Research Group, Anthropic says.
Some questions remain open. The P-256 run skipped one curve that looked equally good, and P-224's skipped three. Anthropic doesn't know why, though it argues there are too few to hide weak curves. One binary curve seed, B-163, is still unexplained, as are the base points of P-224, P-256, P-384 and P-521.
Image: Anthropic
Co-author Steve Weis wrote on X that the team found no test the skipped curves failed, and asked whether it was "buggy code" or something else. The findings come from Anthropic's own researchers, and independent cryptographers have yet to publish a full review. For now, the clock looks like a far more ordinary culprit than the NSA.
Comments