The Mystery That Outlived Its Best Clue
For a quarter century, a handful of unexplained numbers have been sitting inside the encryption that protects nearly everything you do online. ECDSA — the elliptic curve cryptography standard NIST adopted in 2000 as part of FIPS 186-2 — underpins a huge share of the web’s encrypted connections, and buried in that standard are “seed” values the NSA supplied with zero explanation of where they came from.
That silence bred decades of suspicion. If the NSA had quietly searched through countless candidate seeds until it found one that produced a curve with a hidden weakness, no one could tell just by looking at the finished standard. The best lead for years came from Jerry Solinas, the longtime NSA mathematician behind the curves, who said in 2015 that the seeds were probably hashes of a joke phrase along the lines of “Give Bob and Jerry a raise.” Solinas died in 2023, the archives were gone, and cryptographer Filippo Valsorda put up a $12,288 bounty for anyone who could trace the seeds back to their source — tripled to $36,864 if the winner gave it to charity.
The 30-Minute Solve
In October 2026, a curious Anthropic employee asked an internal research model to crack the seeds — deliberately withholding the joke-phrase tip that had sent human researchers down a dead end for years. In under half an hour, according to Anthropic’s research post, Claude had the answer: the humans’ best lead was wrong.
The seeds weren’t hashes at all. They were outputs of lrand48, a weak pseudorandom number generator shipped with 1990s C libraries, seeded by nothing more exotic than the computer’s clock. Claude’s path there was itself a small piece of applied cryptanalysis: it wrote a scanner that slid along each published seed bit by bit, testing adjacent chunks against 34 combinations of 1990s-vintage generators. Then it noticed something odd — several seeds had their top bits cleared across all 20 bytes, a pattern that would occur by chance roughly once in 5,810 tries. That was the signature of lrand48, which returns only the top 31 of its 48 bits of internal state.
From there, Claude used lattice reduction — the LLL algorithm — to recover the generator’s hidden state bits, then ran the generator backward to the form srand48 would have set at initialization. For all ten prime-curve seeds, that initialization value turned out to be a Unix timestamp between May 1997 and April 1998. The P-256 seed — C49D3608 86E70493 6A6678E1 139D26B7 819F7E90 — was generated at 01:52:34 UTC on August 16, 1997, on iteration 1,842. Anthropic even published reproduction code: plug that timestamp into a loop around lrand48 and the exact byte string that’s sat in the NIST standard since 2000 falls out.
The Bounty and the Loose Ends
The $36,864 bounty will be donated to the Internet Security Research Group. But not everything is solved: the B-163 binary seed fits nothing Claude tried, and the base points for the P-224, P-256, P-384 and P-521 curves remain unexplained. Claude did crack part of that second mystery, tracing six base points to Arjen Lenstra’s FreeLIP long-integer library — as far as anyone knows, the first explanation of any NIST base point.
Why This Matters
This is a reassurance story, not an alarm story — Anthropic is explicit that there is nothing to patch and nothing to do differently. But the finding cuts one way that counts: a deliberately weakened curve would be essentially indistinguishable from a clean one, so proving the seeds came from a boring, reproducible clock-based process removes one of the last reasons to suspect a planted NSA backdoor in the curves your browser trusts every day.
And there’s a second story here that matters for AI itself. As OfficeChai noted, this lands in a run of Claude doing genuine research — from uncovering a CRISPR-like biological system to helping disprove an 87-year-old math conjecture. Anthropic now tracks how much of its own internal research runs on Claude, and a 25-year-old open question closed in 30 minutes is the kind of result that shows up in those metrics.
Meanwhile in AI Tech: read how Anthropic hardened Claude against distillation attacks, and why Jamie Dimon warned of 10x cyber risk in the AI era.
