The seeds behind NIST's elliptic curves came from a clock. On Oct. 16 Anthropic published a run in which Claude, an AI model, traced the five numbers to a 1990s C library generator1. The generator, lrand48, had been seeded with a Unix timestamp. P-256, the curve under most of the web's certificates, came from the 1,842nd candidate of a run begun on Aug. 16, 1997.
Filippo Valsorda had posted a bounty for the answer. The cryptographer rebuilt the math in Go and matched every seed on Oct. 162.
Bitcoin runs on another curve. Its signatures use secp256k1, a curve whose constants were picked by a rule anyone can rerun1112. The CryptoLately.com Desk read the 29 years behind the mystery, from a Usenet thread in 1999 to a bounty paid on Oct. 15, 2026, to see what the answer changes for the chain that sidestepped the question.
A seed run on Aug. 16, 1997 was explained on Oct. 16, 2026, 29 years later
Dated events from the NIST curve seeds to the bounty's payment, 1997 to 2026
Read the chart as a table
| Date | Event |
|---|---|
| Aug. 16, 1997 | P-256 seed run. lrand48 seeded by a Unix clock |
| Aug. 2007 | Dual EC backdoor shown. Shumow and Ferguson at CRYPTO 2007 |
| Dec. 2013 | Reuters: $10 million. NSA payment to RSA Security reported |
| April 21, 2014 | NIST drops Dual EC. Removed from draft SP 800-90A Rev. 1 |
| Oct. 21, 2015 | Riddle paper. Koblitz and Menezes |
| Oct. 5, 2023 | Bounty posted. $12,288, tripled to $36,864 for charity |
| Oct. 15, 2026 | Bounty claimed. Anthropic's team, paid to ISRG |
| Oct. 16, 2026 | Answer published. A clock, and lrand48 |
Five Numbers Left Unexplained
NIST adopted ECDSA in 2000 inside a standard called FIPS 186-21. Its curves came from an earlier ANSI standard, and each one was built from a 160-bit seed run through a hash3. The NSA supplied the seeds "with no explanation or justification," Anthropic's post says, and people on Usenet were already asking where they came from in 19994.
Jerry Solinas, the NSA mathematician who handled the seeds, gave the best answer anyone had. In 2015 emails that Steve Weis quotes, Solinas wrote: “We built all the seeds via hashing (SHA-1, I think) from the ASCII representation of a humorous message. Unfortunately, we can remember neither the (exact) message nor the details of how we hashed”4. He added a joke about the archives sitting "on a hard drive near the Ark of the Covenant". Solinas died in 20233.
Weis tried the official route. In 2018 he filed Freedom of Information Act requests with NIST and the NSA for any documents on the seeds4. The story stayed where Solinas left it.
Why Anyone Cared
A seed sounds harmless until you know what a seed can hide. Whoever picks it freely can try seed after seed until a curve has a weakness only they know about1. In 2007 that fear got a working example, in a different NIST standard.
Dan Shumow and Niels Ferguson showed at the CRYPTO 2007 conference that a random number generator called Dual_EC_DRBG "contains a weakness that can only be described as a backdoor," Bruce Schneier wrote that November5. Six years later, in December 2013, Reuters reported a payment6. The NSA had paid RSA Security $10 million to make that generator the default in its BSAFE toolkit, the report said. "RSA issued a vehement but artfully worded quasi-denial," Ed Felten of Princeton wrote on Dec. 23, 2013.
NIST dropped the generator from its guidance on April 21, 2014, citing its own evaluation and "the lack of public confidence in the algorithm"9. With one NIST standard shown to carry a backdoor, the unexplained seeds in another looked worse. Neal Koblitz and Alfred Menezes took up the theories in a 2015 paper titled "A Riddle Wrapped in an Enigma"10. Jamie Redman of Bitcoin.com News summed up the mood last week: “For 25 years, cryptographers suspected the NSA's mysterious encryption seeds might conceal a backdoor”13.
The Curve Bitcoin Chose
Bitcoin's designers took a different curve from the same standards body that wrote the NIST list. The SEC 2 document from Certicom Research defines secp256k1 as a Koblitz curve12. Its parameters “were chosen by repeatedly selecting parameters admitting an efficiently computable endomorphism until a prime order curve was found,” the document says. The equation is y² = x³ + 7, and the prime is 2²⁵⁶ minus 2³² minus 97711.
That rule leaves little room for a hidden choice. The Bitcoin Wiki notes the curve was almost unused before Bitcoin11. Its constants were selected in a predictable way, which cuts the chance of a planted weakness. SafeCurves, the site Daniel J. Bernstein and Tanja Lange maintain, grades curve-generation processes by how much freedom the generator had7. SafeCurves rates NIST P-256 as "manipulatable" and secp256k1 as "somewhat rigid"8.
The seeds answer leaves Bitcoin exactly where it was. Its curve carried a reproducible recipe from the start, so the clock behind P-256 leaves every Bitcoin signature untouched. What it changes is the story about the curve Bitcoin passed over.
Thirty Bits, Thirty Minutes
Valsorda put up the bounty on Oct. 5, 2023: $12,288 for the hidden sentences, tripled to $36,864 if the winner gave it to charity3. The answer was a timestamp, with zero sentences involved. Ten Anthropic researchers claimed the bounty on Oct. 15 and sent the full $36,864 to the Internet Security Research Group, the nonprofit behind Let's Encrypt21.
Oct. 16, 2026: the P-224 run needed 7,026 candidates, 50 times P-192's 139
Candidate number of each NIST prime-curve seed in its lrand48 run, per Anthropic
- P-256: 1,842
- The other prime curves
Source: Anthropic [1].
Read the chart as a table
| Item | Value |
|---|---|
| P-192 | 139 |
| P-521 | 1,136 |
| P-256 | 1,842 |
| P-384 | 2,688 |
| P-224 | 7,026 |
Claude got there by guessing the software. The model scanned each published seed for the signature of a 1990s generator1. Four seeds had a zero in the top bit of all 20 words, a tell for lrand48. A standard lattice method then recovered the generator's hidden state. Then it wound the generator backward to a start value that read as a Unix date. Every prime-curve seed landed between May 1997 and April 1998. P-192's seed came 139 candidates into its run. For P-521 the count was 1,136, and for P-384 it was 2,688. The P-224 run went to candidate 7,026.
The numbers matter for the backdoor theory. In 2017 Bernstein and Lange described a method for aiming at a class of weak curves2. The method would have needed about 70 bits of freedom in choosing seeds. Valsorda counted what a clock and a candidate index allow. Even with any timestamp in 1997 or 1998 and any of the first 16 candidates, "they would have had barely 30 bits of freedom," he wrote.
Oct. 16, 2026: Valsorda counts 30 bits of freedom, against 70 an attack needed
Bits of freedom in choosing a NIST curve seed, per Valsorda
- What the clock allows: 30 bits
- What an attack needs: 70 bits
Source: Filippo Valsorda [2].
Read the chart as a table
| Item | Value |
|---|---|
| 2017 attack idea | 70 bits |
| A clock allows | 30 bits |
Anthropic drew the same line. “This is not a cryptographic break, new attack, or weakness in the ECDSA curves. In fact, this makes us more confident the curves were chosen without any backdoors or intentional weaknesses,” the post says1.
The Case For and the Case Against
Valsorda makes the case that the matter is closed. “Along with deterministic and hedged ECDSA signing algorithms, formally verified field implementations, and the 2015 complete addition formulas by Renes, Costello, and Batina, this nicely completes the 'rehabilitation arc' of NIST elliptic curve cryptography, which I would now personally recommend over Curve25519/Ed25519/X25519,” he wrote2. He added one line of timing: “Just in time for them to be retired in favor of post-quantum signatures”.
Bernstein and Lange make the standing case against trusting any curve whose recipe was ever a secret. “There are documented instances, and many more suspected instances, of standards being manipulated by attackers,” they write on SafeCurves7. "SafeCurves requires rigidity to protect ECC users against this possibility," the page continues, and rigidity means a process anyone can rerun from the start.
Three pieces of the record stay open on Anthropic's own account. One binary-curve seed, B-163, matches zero of the generators Claude tried1. The base points of P-224, P-256, P-384 and P-521 remain unexplained. Some valid candidates were skipped, including candidate 876 of the P-256 run, for reasons the record omits.
By the numbers
- 1,842: P-256's candidate number in a run begun at 01:52:34 UTC on Aug. 16, 19971.
- 7,026: candidates the P-224 run needed, against 139 for P-192, 1,136 for P-521 and 2,688 for P-3841.
- $36,864: paid to the Internet Security Research Group on Oct. 15, 2026, tripled from $12,28823.
- 30 bits of freedom at most for a seed-picker with a clock, against the 70 a 2017 attack idea needed2.
- $10 million: what Reuters reported the NSA paid RSA Security, in December 20136.
- April 21, 2014: NIST removed Dual_EC_DRBG from its draft guidance9.
- 2018: the year Weis filed FOIA requests with NIST and the NSA4.
What to watch
The B-163 seed and the four unexplained base points are the open items1. Anthropic published its scripts under CC0 for anyone to extend. Valsorda's own list of accepted-but-unpublished candidates names the gaps a second researcher could close2. A wallet or exchange that still signs with P-256 can cite the find as one more reason the curve holds. The Bitcoin chain keeps the curve that sat outside the question.
Sources
- Anthropic Frontier Red Team, "Claude reveals ECDSA curve origins," Anthropic, Oct. 16, 2026, https://www.anthropic.com/research/ecdsa-curve-origins
- Filippo Valsorda, "The NIST Elliptic Curves Seeds Bounty Has Been Claimed," Oct. 16, 2026, https://words.filippo.io/seeds-solved/
- Filippo Valsorda, "Announcing the $12k NIST Elliptic Curves Seeds Bounty," Oct. 5, 2023, https://words.filippo.io/dispatches/seeds-bounty/
- Stephen A. Weis, "How were the NIST ECDSA curve parameters generated?," September 2023, https://saweis.net/posts/nist-curve-seed-origins.html
- Bruce Schneier, "Did NSA Put a Secret Backdoor in New Encryption Standard?," Schneier on Security, Nov. 15, 2007, https://www.schneier.com/essays/archives/2007/11/did_nsa_put_a_secret.html
- Ed Felten, "RSA doesn't quite deny undermining customers' crypto," CITP Blog, Princeton University, Dec. 23, 2013, https://blog.citp.princeton.edu/2013/12/23/rsa-doesnt-quite-deny-undermining-customers-crypto/
- Daniel J. Bernstein and Tanja Lange, "SafeCurves: Rigidity," Jan. 22, 2017, https://safecurves.cr.yp.to/rigid.html
- Daniel J. Bernstein and Tanja Lange, "SafeCurves: choosing safe curves for elliptic-curve cryptography," Jan. 22, 2017, https://safecurves.cr.yp.to/
- NIST, "NIST Removes Cryptography Algorithm from Random Number Generator Recommendations," April 21, 2014, https://www.nist.gov/news-events/news/2014/04/nist-removes-cryptography-algorithm-random-number-generator-recommendations
- Neal Koblitz and Alfred J. Menezes, "A Riddle Wrapped in an Enigma," Cryptology ePrint Archive, Paper 2015/1018, Oct. 21, 2015, https://eprint.iacr.org/2015/1018
- Bitcoin Wiki, "Secp256k1," accessed Oct. 19, 2026, https://en.bitcoin.it/wiki/Secp256k1
- Certicom Research, "SEC 2: Recommended Elliptic Curve Domain Parameters, Version 2.0," Standards for Efficient Cryptography Group, Jan. 27, 2010, https://www.secg.org/sec2-v2.pdf
- Jamie Redman, "Claude AI Cracks the NSA's 25-Year Cryptography Seed Mystery," Bitcoin.com News, Oct. 16, 2026, https://news.bitcoin.com/featured/claude-ai-cracks-the-nsas-25-year-cryptography-seed-mystery/