Claude reveals ECDSA curve origins: https://words.filippo.io/seeds-solved/

Anthropic announced that an internal Claude research model resolved a quarter-century cryptographic mystery by uncovering the exact origin of the seeds used in the widely deployed ECDSA elliptic curve standards, as outlined in anthropic.com's report. For decades, security researchers questioned whether curve parameters submitted by the National Security Agency to the National Institute of Standards and Technology harbored deliberate backdoors. In under half an hour of autonomous investigation, Claude discovered that the mystery seeds were not hashes of secret passphrases at all, but mundane outputs generated by the standard C library random number generator lrand48 initialized with standard Unix timestamps between May 1997 and April 1998.

This deep dive breaks down the technical mechanism Claude reconstructed, the reverse engineering of linear congruential states, and what the discovery means for modern internet protocols. Systems engineers, cryptographers, and security architects who rely on the FIPS 186-2 Digital Signature Standard can review the mathematical proof showing how standard Unix clock values, rather than state-sponsored subversion, produced the foundational parameters protecting modern communications.

Claude reveals ECDSA curve origins: what actually changed

The discovery finally settles speculation surrounding the FIPS 186-2 Digital Signature Standard adopted by NIST in 2000. When NIST published the specifications for curves across prime and binary fields, it included arbitrary seed parameters, such as the P-256 curve seed C49D3608 86E70493 6A6678E1 139D26B7 819F7E90, whose hash fixed the curve coefficient b without documentation of provenance. Longstanding lore, recounted by cryptographers Neal Koblitz and Alfred Menezes in A Riddle Wrapped in an Enigma, suggested that NSA staffer Jerry Solinas and developer Bob Reiter generated the values from a humorous passphrase like Give Bob and Jerry a raise. After Solinas passed away in 2023 without finding archive records, an open community bounty remained unclaimed.

Anthropic employees bypassed the passphrase rumor and tasked an internal research model with investigating the seeds directly. In less than thirty minutes, Claude determined that the seeds for NIST P-192, P-224, P-256, P-384, and P-521 were never created with cryptographic hash algorithms. Instead, the generating utility simply drew sequential twenty-byte candidate chunks from the standard C library pseudorandom number generator lrand48 initialized by a Unix timestamp. For P-256, the standardization process simply required 1,842 iterations of twenty-byte draws to yield the published seed parameter.

Claude reveals ECDSA curve origins: how it works

To reconstruct the derivation, Claude anticipated that 1990s curve-generation utilities used standard pseudorandom number generators included in operating system C libraries. The model built a sliding scanner across each published seed one bit at a time, evaluating 34 combinations of vintage generators and output slices. Claude noticed that four of the ten analyzed seeds possessed a leading zero across all twenty 32-bit words, an alignment that has a random chance probability of 1 in 5,810. This structural artifact exposed the signature of lrand48, which returns only the upper 31 bits of a 48-bit internal state. Claude then exhaustively checked the remaining 2¹⁷ hidden bits for the first word to reproduce the succeeding four words across the curves.

For the prime-curve seeds, fewer output bits had been retained, converting state recovery into a truncated linear congruential generator lattice problem that Claude resolved with the Lenstra–Lenstra–Lovász basis reduction algorithm. The scan revealed that five NIST prime seeds and five seeds from the ANSI X9.62 standard conformed to the transformation lrand48() >> 23. Claude then ran the linear generator backwards until reaching the 0x330E low-order signature of an srand48 seed. Every prime-curve initialization matched a Unix timestamp from May 1997 to April 1998, while four binary curves mapped to April 17, 1998 when doubling their apparent February 1984 timestamps, matching a run execution two weeks after P-224.

Claude reveals ECDSA curve origins: why it matters now

The findings confirm that the standard NIST elliptic curves do not contain deliberate mathematical backdoors planted through seed manipulation. Because the NSA provided the constants to NIST without derivation notes, cryptographers had spent decades questioning whether the parameters had been selected against undisclosed algebraic vulnerabilities. Demonstrating that the seeds stem from an off-the-shelf pseudorandom generator initialized with system clock times eliminates plausible room for subversion, establishing that the standardized parameters were chosen through ordinary engineering routines rather than malicious optimization.

Beyond the seeds, Claude also identified the origin of base point G for six early curves produced in May 1997, specifically NIST P-192, ANSI X9.62 prime192v2, prime192v3, and prime239v1 through prime239v3. These points were generated using the pseudorandom generator from Arjen Lenstra's FreeLIP long-integer package, also included in Victor Shoup's NTL library. The generation procedure initialized the generator with a small integer, discarded seven initial outputs, and tested 26-bit candidate coordinates reduced modulo p until hitting the curve. The initialization seeds were identified as 20000 for P-192, 20420, 20507, and 20509 for prime239v1 through v3, and 20512 and 20517 for prime192v2 and v3.

Claude reveals ECDSA curve origins: who is affected

This finding directly affects enterprise infrastructure, security engineers, and software vendors relying on ECDSA signatures in production. The revelation does not constitute a cryptographic break, an attack vector, or a newly identified flaw in the underlying mathematics. Anthropic noted that researchers should treat the news as a closing chapter to historic speculation rather than an operational crisis. Organizations do not need to patch cryptographic libraries, cycle existing public-private keys, or deprecate current signature suites in response to the research.

The confirmation provides reassurance to practitioners who have deployed ECDSA across web public key infrastructure, transport layer security, hardware security modules, and identity federation. While many modern deployments have migrated toward alternative constructions such as Ed25519 due to implementation ergonomics, legacy and regulated enterprise systems running NIST prime curves can maintain operations without fear that their elliptic curve domain parameters were pre-compromised at inception.

Claude reveals ECDSA curve origins: what to watch

While the seed derivation mechanism is solved, several historical questions remain open. In the P-256 generation run, the standard curve was selected at candidate iteration 1,842, even though candidate iteration 876 had already produced an acceptable prime-order curve of proper size using the identical parameter criteria. Similarly, the P-224 execution passed over three viable candidate curves before halting on its standardized choice. Cryptographers have not yet established whether the software discarded these intermediate candidates for specific mathematical attributes or due to secondary filtering criteria in the script.

Additionally, the base points for NIST P-224, P-256, P-384, and P-521 do not match the FreeLIP selection pattern that generated the P-192 and ANSI X9.62 coordinates. The method used to determine base point G for those larger curves remains unexplained. The community will watch whether continued reverse engineering of 1990s academic packages surfaces the precise generation script used by NSA authors before the FIPS 186-2 release.