Anthropic says its Claude model solved a 25-year-old cryptography puzzle in under thirty minutes, tracing the origin of the seeds behind NIST’s elliptic curves, which the NSA supplied. The finding is not a vulnerability, and bitcoin, which relies on a different curve, is not affected.
๐ Key takeaways
- Claude traced the origin of NIST curve seeds that had remained unexplained since their adoption in 2000.
- The seeds came from a standard pseudorandom generator (lrand48) initialized with Unix timestamps from 1997 and 1998.
- No new attack: deployed NIST curves are not weakened, and users need not take any action.
- Bitcoin uses the distinct secp256k1 curve and is untouched; the quantum threat remains a separate issue.
A 25-Year-Old Puzzle
Elliptic curves sit at the heart of public-key cryptography, which secures much of the internet as well as bitcoin wallets. In 2000, the NIST (National Institute of Standards and Technology) adopted a set of curves whose starting parameters, known as seeds, had been supplied by the NSA. The seeds were public, but their origin was never documented.
Suspicion grew after Edward Snowden’s revelations about NSA efforts to weaken cryptographic standards. In 2015, cryptographers Neal Koblitz and Alfred Menezes published “A Riddle Wrapped in an Enigma,” analyzing the controversy. Menezes, who had helped write the original standard, recalled receiving the seeds from NSA mathematician Jerry Solinas in 1997. Solinas died in 2023, leaving the trail unexplored.
A Search That Went Nowhere
Security researcher Steve Weis spent years trying to trace the seeds’ provenance, including public records requests filed in 2018. NIST replied that it had no documentation, while the NSA stopped responding. In 2023, cryptographic engineer Filippo Valsorda and other contributors put up a bounty of $12,288, rising to more than $36,000 if the winner donated it to charity. It went unclaimed until Claude took on the problem.
This year, an Anthropic employee asked the internal Claude model to investigate without sharing an earlier theory involving a humorous “password.” The model took a different route: it assumed the software that generated the curves in the 1990s used pseudorandom number generators built into the C libraries of the era.
A Method Built on Timestamps
The Telltale Pattern
Claude wrote a scanning program covering 34 combinations of generators and truncation methods. It spotted an anomaly: in some seeds, the high-order bits were all zero. Among ten seeds written as five 32-bit words, four showed the pattern across 20 words of 32 bits, a chance probability of roughly 1 in 5,800. That signature matches lrand48, which returns only the 31 high-order bits of its 48-bit internal state.
Rebuilding the Hidden State
To recover the masked state, Claude exhaustively tested all 2^17 possibilities for the 17 hidden bits, then checked whether the next four words matched consecutively. The method worked for all four seeds. For the prime curves, the model had to solve a lattice problem (a crystal lattice) using the LLL basis-reduction algorithm to recover the internal state from a limited number of retained bits. In the end, all ten NIST prime-curve seeds and the five ANSI X9.62 seeds were regenerated from their 48-bit internal states, with exact matches that chance cannot explain.
Working Backwards in Time
Tracing each state back, Claude found that every initial srand48 state could be read as a Unix timestamp, clustered between May 1997 and April 1998. The key results are summarized below.
| Curve | Element recovered | Proposed reading |
|---|---|---|
| P-256 | 1,842nd candidate from lrand48 | Timestamp of 16 August 1997, 01:52:34 |
| P-192 | 139th candidate | Timestamp of 18 May 1997 |
| Binary curves | Initial states | April 1998, clock possibly halved |
| B-163 | Seed | Unexplained |
Other seeds map to values such as 20,000, 20,420, 20,507, 20,509, 20,512 and 20,517, which correspond to time intervals. The binary-curve states point to April 1998, suggesting the original program may have divided the system clock by two.
The Base Points
The model also traced the origin of the base points of six curves, including P-192. They were produced by the random number generator in FreeLIP, a big-integer arithmetic library developed by Arjen Lenstra. No process for generating base points of the NIST curves had been explained this way before.
“This is astonishing: it solves the 25-year-old mystery.”
“Wow, it’s a real discovery.”
Claude, Anthropic model
No Break, but Open Questions
Anthropic was clear that the result is not a cryptographic break.
“This is not a cryptographic break, new attack, or weakness in the ECDSA curves.”
Anthropic, company blog post
The company added that the seeds were generated in a very simple way, with a common pseudorandom generator initialized from the clock, which anyone can now reproduce. That reproducibility sharply narrows the room for a hidden manipulation and makes an intentional backdoor much less plausible. No action is required from users of NIST curves.
Some questions remain open:
- The seed of the B-163 curve has not been explained.
- The methods used to generate base points for P-224, P-256, P-384 and P-521 remain unknown.
- For P-256, the 876th candidate met the criteria, but the 1,842nd was selected. The number of skipped candidates is nonetheless too small to support the hypothesis of deliberate selection.
The $36,864 bounty will be paid to the Internet Security Research Group, the nonprofit behind Let’s Encrypt. Valsorda reimplemented the solution in Go and confirmed the match, while the Python code to reproduce the seeds was released under CC0 (public domain).
Bitcoin: Different Curve, Different Risk
Bitcoin was not affected. The network uses secp256k1, defined by two small fixed numbers that leave little room for a hidden weakness. Satoshi Nakamoto never explained the choice, and the curve was rarely used before bitcoin popularized it. Ethereum has adopted it too.
Its simplicity is often cited as a security asset, but a different threat persists: a sufficiently powerful quantum computer could derive a private key from a public key visible on the blockchain, regardless of the curve used. Google recently said its Willow chip cut errors by roughly 40 times in one of the most costly steps of such a calculation. No firm timeline exists for building such a machine.
Conclusion: A Historical Advance, Not an Alarm
Claude’s resolution of the NIST seed mystery reveals no new vulnerability in current elliptic curves. It does shed light on how standardized parameters in use for more than two decades were generated, and it strengthens confidence in them. It also shows Anthropic using AI as a research tool on fundamental cryptography problems.
Three scenarios stand out. In the base case, cryptography teams publish their own verification and the standards remain unchanged. In a transparency-positive case, other researchers apply similar methods to neighboring standards and close the remaining gaps. In a negative case, a more serious anomaly surfaces in parameters that received little scrutiny, reigniting debate over standards transparency. For bitcoin, the direct impact remains nil for now; the longer-term issue is preparing for post-quantum cryptography.
Sources
Cet article est publiรฉ ร titre informatif et รฉducatif. Il ne constitue en aucun cas un conseil en investissement. Faites vos propres recherches (DYOR) avant toute dรฉcision.
