Skip to content
EventPast event

Anthropic: Claude traces NIST curve seed origins in half an hour

5 reports5 reporting sourcesplus 6 outlets covering itLatest report

Start here

AI overview

Anthropic announced a research result: an employee gave a problem that had troubled the cryptography community for more than twenty years to its internal research model Claude, and Claude traced the origin of the seeds of five standard elliptic curves, NIST P-192, P-224, P-256, P-384 and P-521, in less than half an hour, without obtaining the passphrase clues previously rumored. According to the disclosure, these seeds are not the output of a hash algorithm, but were produced by the weak pseudorandom number generator lrand48 from a 1990s C language library, with the initial state taken from a Unix timestamp. Claude scanned 34 combinations of random number generators and output truncation methods, found that the 20 32-bit integers into which four sets of seeds were split all had 0 in their highest bit, and on that basis located lrand48, and by identifying the output characteristics of 1990s PRNGs, then used the LLL algorithm to recover the state of the truncated linear congruential generator. When NIST standardized the ECDSA curves in 2000, the NSA provided these seeds but gave no explanation, which long fueled outside speculation about a backdoor. Another X user said the puzzle's bounty was originally 12,288 USD, was posted for three years with no one claiming it, tripled after choosing to donate to a charity, and in the end 36,864 USD was donated to ISRG, which is behind Let's Encrypt.

Generated by AI from reports · Updated 11 days ago

Progress timeline

Oct 20
Oct 19
  1. X @MinLiBuilds
    The Anthropic Red report says Claude solved the NSA elliptic curve seed mystery in half an hour, and the 36,864 USD bounty was donated to ISRG

    X user @MinLiBuilds says Claude solved the NSA elliptic curve seed mystery in half an hour, for a bounty of 36,864 USD. It reverse-engineered the generation algorithm, found that the seed came from a 1990s C language random number generator, and reproduced the original timestamps of 1997–1998. The bounty, which had gone unclaimed for three years, was originally 12,288 USD; after choosing to donate it to charity it tripled, and was ultimately donated to ISRG, the organization behind Let’s Encrypt.

Oct 18
Oct 17
  1. The Decoder
    Anthropic's Claude cracks NSA's 25-year-old cryptography puzzle in under 30 minutes

    Anthropic says its Claude solved the 25-year puzzle of the seed source for the ECDSA standard curves in under 30 minutes: the seeds were generated by the simple C random number generator lrand48, initialized with Unix timestamps between May 1997 and April 1998. When NIST standardized the ECDSA curves in 2000, the NSA provided these seeds without any explanation, which long fueled outside speculation about backdoors. Claude found that lrand48 outputs only 31 bits, and that the high-order bits of some seeds were systematically zero, thereby identifying the pattern. Anthropic says this makes a deliberate backdoor less likely, and donated the $36,864 bounty to the Internet Security Research Group.

  2. WeChat · QbitAI
    Anthropic says Claude identified the seed sources of five NIST elliptic curves in half an hour

    According to Anthropic's disclosure, Claude took less than half an hour to determine how the seeds for NIST's five standard elliptic curves (P-192, P-224, P-256, P-384, P-521) were generated: the seeds came from the lrand48 pseudorandom number generator in a 1990s C library, initialized with a Unix timestamp. Claude wrote a scanning program to check the binary digits of the public seeds bit by bit, tested 34 combinations of generators and output truncation methods, and found that the highest bits of the 20 32-bit integers split from four groups of seeds were all 0, thereby pinpointing lrand48, and then used the LLL lattice basis reduction algorithm to recover the truncated state. Tracing back the initialization input of srand48 yielded a time range from May 1997 to April 1998; for P-256, this corresponds to August 16, 1997, UTC 01:52:34, and taking the 1842nd candidate group yielded a seed starting with C49D. The previously circulated claim was that the seeds came from the hash of a salary-increase joke password, and the bounty initiator has independently verified this result.

  3. WeChat · Synced (Jiqizhixin)
    Anthropic announced that Claude solved a more-than-two-decade cryptography puzzle in half an hour

    Anthropic published a research result: an employee gave Claude's internal research model a problem that had troubled the cryptography community for more than two decades, and Claude traced the seed sources of NIST's P-192, P-224, P-256, P-384, and P-521 in less than half an hour, without receiving the previously rumored passphrase clues. These seeds were generated by the weak pseudorandom number generator lrand48 from the C library, with the initial state taken from a Unix timestamp; Claude scanned 34 combinations of random number generators and truncation methods, identified the feature that some seed high-order bits were zero, then exhaustively searched the hidden bits and used the LLL algorithm to recover the generator's internal state, and traced that the base points of 6 curves including P-192 came from the random number generator of the big integer software package FreeLIP. Anthropic said this finding did not break ECDSA and did not introduce a new attack method, but it reduced the possibility that the relevant curves were deliberately backdoored; the seed of the B-163 curve and the base point generation method of some curves still have no identified source.

  4. Anthropic Red TeamingSelected
    Claude reveals the origin of the ECDSA curve parameters

    Anthropic says its internal research model Claude found in less than half an hour the origin of the seeds for the NIST P-192, P-224, P-256, P-384, and P-521 curves: they are not the output of a hash algorithm, but were produced by the C library lrand48 random number generator seeded with Unix timestamps. Anthropic employees posed this question in October 2026, and Claude identified the output characteristics of the 1990s PRNG, then used the LLL algorithm to recover the truncated linear congruential generator state, obtaining the timestamp corresponding to each seed; for example, P-256 required 1842 iterations. Claude also found that the six curve base points generated in 1997 came from FreeLIP's random number generator, with seeds from 20000 to 20517. The seed bounty of $36,864 will be donated to the Internet Security Research Group.

Related discussion

Total 136 items

Attention trend

New sources per day

132 in 14 days·most 82 (Oct 17)·today 0

  • Oct 17: 82 new sources (6 outlets, 76 accounts)
  • Oct 18: 25 new sources (2 outlets, 23 accounts)
  • Oct 19: 20 new sources (3 outlets, 17 accounts)
  • Oct 20: 3 new sources (0 outlets, 3 accounts)
  • Oct 21: 1 new sources (0 outlets, 1 accounts)
  • Oct 22: 0 new sources (0 outlets, 0 accounts)
  • Oct 23: 0 new sources (0 outlets, 0 accounts)
  • Oct 24: 1 new sources (0 outlets, 1 accounts)
  • Oct 25: 0 new sources (0 outlets, 0 accounts)
  • Oct 26: 0 new sources (0 outlets, 0 accounts)
  • Oct 27: 0 new sources (0 outlets, 0 accounts)
  • Oct 28: 0 new sources (0 outlets, 0 accounts)
  • Oct 29: 0 new sources (0 outlets, 0 accounts)
  • Oct 30: 0 new sources (0 outlets, 0 accounts)

Hourly attention

Current attention 37·Peak in the comparable period 38 (Oct 23 12:00)·Change over the comparable past 24 hours –

010203040Oct 2312:00Oct 2316:00Oct 2319:00Oct 2323:00