Claude Traced the NIST Elliptic Curve Seeds in Under Half an Hour: A 1997 Clock Reading and a C Library Random Number Function, With the $36,864 Bounty Going to ISRG

A 160-bit number nobody could explain

P-256 is one of the most widely used elliptic curves in TLS and similar protocols today. Like the other NIST curves from the same batch, its parameters are derived by hashing a published 160-bit "seed," but the standard never said where the seed came from. The popular story was that it was a hash of a humorous phrase, and Jerry Solinas, the cryptographer who generated the seeds, died in 2023. That same year, Filippo Valsorda set up a bounty for whoever could explain them.

How Claude found it

Anthropic's Frontier Red Team wrote on October 16 that an employee simply asked an internal research model whether it could work out how the seeds were made, without passing on the hash-of-a-phrase clue. The model noticed that the top bits of some seeds were all zero, guessed a common 1990s pseudorandom generator, wrote a scanner to test for its output pattern, settled on the C library's 48-bit linear congruential generator, then used LLL lattice reduction to recover the internal state from truncated output and step it back to the state set by srand48(timestamp). According to Anthropic, the origins of the five prime-curve seeds were found in under half an hour.

P-256 came from a run started at 01:52:34 on August 16, 1997, and was the 1,842nd 20-byte candidate; all five timestamps fall between May 1997 and April 1998. The team also explained the seeds of four binary curves, B-233 through B-571, and several ANSI X9.62 example curves.

Verification, and what is still open

On October 16, Valsorda confirmed the bounty had been claimed on October 15 and said he rewrote the generation procedure in Go to check it. His post names the generator as drand48, from the same POSIX 48-bit family; Anthropic writes lrand48. He also notes that the published ANSI X9.62 conditions are not enough to reproduce which candidates were kept: there are two undocumented rules, and one of them still has no explanation. Anthropic lists its own open items: candidate 876 in the P-256 run also yields a valid curve but was skipped, and the B-163 seed and the base points of P-224 through P-521 remain unexplained.

What it means for P-256 users

Anthropic says plainly that this is not a cryptographic break or a new weakness in ECDSA. Valsorda estimates that with this generation method, anyone trying to pick curves on purpose would have had at most about 30 bits of freedom, far short of the 70 bits needed for the kind of manipulation Bernstein and Lange described in 2017. Existing systems have no reason to switch curves. The bounty was originally $12,288; the winners chose to give it to ISRG, which tripled it under the rules to $36,864.