Anthropic says Claude has traced the seeds used to define five widely used NIST cryptographic curves to a C random number generator initialized with Unix timestamps. The finding addresses a long-standing question about where the seeds came from. Anthropic says it does not reveal an attack or a weakness in the curves.
The seeds helped define curves in the ECDSA digital signature standard adopted by NIST in 2000. They were supplied by the NSA without an explanation of how they were chosen, prompting questions about whether the resulting curves could contain deliberate weaknesses.
Claude reproduced the published seeds
In October 2026, an Anthropic employee asked an internal research model to investigate the seeds. According to the company, Claude identified the origins of the P-192, P-224, P-256, P-384 and P-521 seeds in under half an hour. It found that the seeds were drawn from lrand48, a C library random number generator, after it was initialized with a Unix timestamp.
Anthropic says the same method reproduces five additional prime-curve seeds from the ANSI X9.62 standard. The program drew 20 bytes for each candidate seed, then tried another candidate if needed. For P-256, the published seed was candidate 1,842.
Claude also traced four NIST binary-curve seeds to lrand48. Their recovered initialization values appear to represent dates in February 1984. Doubling those values maps them to April 17, 1998, so Anthropic says the program may have halved the clock value. The fifth binary-curve seed, B-163, remains unexplained.
Some curve choices remain unexplained
Anthropic says the timestamp finding makes deliberate weaknesses less plausible, but it does not establish every choice made during curve generation. Some candidates that appeared viable were skipped, including an earlier candidate in the P-256 run. The company says it does not know why. Claude also traced how the base points for P-192 and five ANSI example curves were generated, but the base points for P-224, P-256, P-384 and P-521 remain unexplained.
Anthropic says the findings call for no change in how the curves are used. The $36,864 bounty for finding the seeds will be donated to the Internet Security Research Group.
