Claude traces the origins of long-mysterious NIST curve seeds

The numbers behind a public standard

Elliptic-curve cryptography lets computers create digital signatures and establish trust without sharing a private key. NIST's Digital Signature Standard includes a family of curves used in security protocols and software. Several of the curves have a published seed value that is hashed to calculate a curve parameter. The NSA supplied those seed values in the 1990s, but the standards did not explain how they had been chosen.

That missing explanation led to a persistent concern. If an organization secretly tried many possible curves and selected one with a hidden mathematical weakness, it might know a way to attack systems using that curve. The seed itself was never secret, but its unexplained origin made the selection process difficult for others to reproduce. The suspicion gained force after public disclosures about NSA efforts to influence cryptographic standards.

Researchers had pursued several possible explanations, including the idea that the seeds were hashes of a phrase. Anthropic says its employees had also explored that lead without success. Its account says an employee instead asked Claude to investigate the seed values without suggesting the phrase theory. In less than half an hour, the model produced a different explanation that could be checked by running the algorithm.

The discovery covers the five prime-field seeds associated with NIST curves P-192, P-224, P-256, P-384 and P-521. Anthropic also reports the same pattern in five prime-field seeds from the ANSI X9.62 standard. That wider match matters because it gives investigators more than one unexplained number to test against the proposed process.

How the reconstruction worked

The proposed generator is lrand48, a linear congruential pseudorandom number generator available in older C libraries. A pseudorandom generator follows a deterministic rule: once its internal state is known, its output can be reproduced. The method is useful for ordinary simulation and simple randomized tasks, but it is not suitable for creating cryptographic secrets that must resist prediction.

Anthropic says Claude noticed that the published seed bytes fit truncated outputs from lrand48. The model used a lattice-reduction technique to recover possible internal states from those partial outputs. It then tested whether the recovered state could be stepped backward to the form produced by the generator's initialization routine. A matching state was not enough on its own, so the model also checked whether the resulting initialization values corresponded to plausible timestamps.

The account says the recovered timestamp seeds for the ten prime-field values fell between May 1997 and April 1998. For P-256, reproducing the published value required 1,842 batches of candidate bytes from the generator. A candidate was 20 bytes long, and the process continued until the prescribed bytes matched the seed. The timestamp and sequence index together form a compact explanation that anyone can independently rerun.

This is an example of combining mathematical reasoning with computation. Lattice reduction, including the Lenstra–Lenstra–Lovász algorithm, can expose hidden structure in approximate or partial integer information. Here it helped recover a small generator state from pieces of its output. The result was then checked against public values, rather than accepted because a language model asserted it.

Anthropic's account still leaves details open. It says the team cannot yet explain why some otherwise usable candidates were skipped or how every other curve parameter was selected. A reproducible generator sequence makes a deliberate hidden weakness less likely, but it does not document every decision made during a standards process. Independent cryptographers can inspect the method and decide whether the evidence supports the same conclusion.

What the finding does and does not say

The seeds in question were published as part of the standards. The new work therefore does not reveal a private key, recover a wallet, decrypt intercepted messages or demonstrate an attack on a deployed system. It explains how public constants may have been generated. Anthropic characterizes the result as closing a historical provenance question and says users of the NIST curves do not need to make changes.

There is a crucial distinction between generating a standard's public parameters and generating a user's private key. If a wallet or server used a weak, predictable generator to create its private key, an attacker who could reconstruct that generator state might be able to predict the key. That would be a serious implementation failure. But the suspected 1990s process produced public curve seed values, not the private signing keys used by each person or service.

The finding also does not amount to proof that every NIST curve is mathematically invulnerable. Cryptographic confidence comes from public analysis, implementation quality and continued review. The reconstruction addresses one concern about parameter selection. It does not replace cryptanalysis of the curves, nor does it establish how all the standards decisions were made.

For now, the practical message is proportionate. There is a credible, reproducible explanation for the NIST seed values, and the specific backdoor theory is less plausible. Organisations should continue using supported cryptographic libraries and follow their normal security-update process. The sources do not advise an emergency migration away from the curves.

Bitcoin uses a different curve

Bitcoin was not among the curves whose seed origins were reconstructed. Its signatures use secp256k1, a curve with a comparatively simple equation and parameters that leave fewer unexplained choices than the NIST curves discussed here. That distinction is why the discovery does not change Bitcoin wallet security by itself.

The CoinDesk report notes that other blockchain systems, including Ethereum, also use secp256k1 for signatures. The curve's history and the way its parameters were selected are separate from the NIST seed question. A story saying Claude 'cracked Bitcoin' would therefore overstate what happened. No Bitcoin private key or secret was derived in this work.

Bitcoin and other public-key systems do face a different long-term question: a sufficiently powerful, fault-tolerant quantum computer could use public-key information to threaten some current cryptographic schemes. The reports stress that no machine near the necessary scale and reliability exists today, and there is no clear arrival date. That possible future risk is not caused by the NIST seed discovery and was not solved by it.

This distinction is useful when reading fast-moving security news. A result about how a public parameter was selected can affect trust in a standard without being an attack. A theoretical future weakness can deserve preparation without implying that systems are currently compromised. Keeping those categories separate helps engineers choose a response based on evidence rather than a dramatic headline.

Why this matters to engineering students in Nepal

The research is relevant to computer engineering because it links several subjects that are often taught separately. A pseudorandom number generator is a short algorithm. Elliptic curves provide the mathematical structure for public-key cryptography. Lattice reduction is a tool for solving problems about integer points. Systems security depends on understanding how all three interact, including the difference between public parameters and secret keys.

For students learning programming, the first practical lesson is to use cryptographic random-number interfaces provided by trusted libraries, not a simulation generator such as lrand48. The second is to test assumptions with independent reproductions. The model's answer became meaningful because it matched published seed values and yielded a sequence others can check. A plausible explanation is a starting point for review, not a substitute for it.

The reporting also shows why technical literacy matters outside a cryptography lab. A headline may compress 'reconstructed how public curve seeds were generated' into 'AI cracks NSA numbers' or imply that Bitcoin is affected. Engineers need to read the underlying result, identify what object was analyzed, and distinguish a demonstrated exploit from a historical explanation. That habit is useful in security operations, software development and technology journalism alike.

Nepal's digital services rely on secure web connections, mobile applications and payment systems, all of which depend on software implementing cryptography correctly. The sources do not report a Nepal-specific incident or a required local change. The immediate value for students is educational: this is a concrete example of reproducible research, standards provenance and careful threat analysis.