Anthropic's Claude Traces NIST ECDSA Curve Seeds to 1990s Random Number Generator

Anthropic reported that its Claude model traced the seeds of NIST P-192, P-256 and other ECDSA curves to lrand48 outputs seeded by Unix timestamps from 1997-1998. The finding replaces a long rumor about hashed phrases with a reproducible process from 1990s C libraries and raises confidence that no backdoor was inserted. No changes are needed for current implementations.

An internal research model from Anthropic solved a long-standing mystery about the seeds used in widely adopted NIST elliptic curves for ECDSA. The model determined in under half an hour that the seeds for the P-192, P-224, P-256, P-384 and P-521 curves came from the C library's lrand48 pseudorandom number generator seeded with a Unix timestamp.

That turned out to be wrong. The decades-old rumor held that the seeds resulted from hashing some humorous or obscure phrase. Anthropic published its findings on October 16, 2026.

Claude spotted statistical patterns in the seeds. Four of the ten seeds showed all-zero top bits in each 32-bit word. The chance of that pattern occurring randomly stood at 1 in 5,810. This pointed directly to lrand48.

The process worked like this. The generator was initialized with a Unix timestamp t. It then ran for a number of iterations n. Each iteration pulled 20 bytes as a candidate seed. The standardized seed for P-256 emerged as candidate 1,842 from its run.

Timestamps for the 10 prime-curve seeds fell between May 1997 and April 1998. Binary curve initializations pointed to dates in February 1984. The model recovered the internal PRNG state. It used brute force for the binary seeds and lattice reduction via the LLL algorithm for the truncated outputs from prime curves.

Anthropic stressed the discovery carries no immediate security implications. "This is not a cryptographic break, new attack, or weakness in the ECDSA curves." The simple and reproducible method makes deliberate backdoors much less plausible. No action is required for users or implementers.

The research also connected base points for several curves to Arjen Lenstra's FreeLIP library. A seed-and-discard recipe generated those points in May 1997. Reproducible code in the post confirms the matches.

But some details remain open. The seed for B-163 stays unexplained. Base points for P-224, P-256, P-384 and P-521 have no identified origin yet. Viable candidate seeds were skipped in certain runs.

Cryptographers had questioned the NIST curves for 25 years. Adoption of ECDSA dates to 2000. The new account replaces speculation with a mundane explanation drawn from 1990s software practices. And it increases confidence in the standards' integrity.

Anthropic's Frontier Red Team conducted the work. The post includes full reproduction steps. One concrete example: the P-256 seed traces to a clock reading of August 16, 1997, at 01:52:34.