Deep dive: Did Claude Really Crack the NIST Curve Seeds?

Why today

On October 16, Anthropic's Frontier Red Team published a post saying an internal Claude research model had worked out where the NIST elliptic curve seeds came from. These curves, P-256 above all, sign a large share of the web's traffic. For about 25 years the seeds were a blank. The NSA supplied them in the late 1990s and never explained them. The best story was that they were hashes of a joke phrase, and nobody could find the phrase. Anthropic says the answer is duller: a stock C library random number generator, started from the system clock. The same day, the cryptographer Filippo Valsorda, who ran a public bounty on this question, wrote that it had been claimed. So what did this actually settle?

Plainly

Start with why seeds matter. A curve standard needs constants. If a designer can pick them freely, they can search for a curve with a weakness only they know about. The defence is a nothing-up-my-sleeve number. You show the constant came from a source you couldn't steer, so readers can check you had no room to shop around. The NIST curves did half of this. Each curve's coefficient is a hash of a published seed, so the curve follows from the seed. But nobody knew where the seed came from. Suspicion sharpened after Dual_EC_DRBG, an NSA-backed random number generator that NIST withdrew in 2014 after reporting that its backdoor was real. Now the result. Picture an old calculator's random button. The numbers look random, but if you know the model and when it was switched on, you can replay every one. Claude bet the seeds came from a generator like that. It noticed that four of the ten seeds had a zero in the top bit of every word. The post puts the odds of that by chance at 1/5810. That fingerprint pointed to lrand48, which returns only the top 31 bits of a 48-bit hidden state. Claude then recovered that hidden state. For some seeds it simply tried every value of the missing bits. For the rest it used a textbook lattice method. Run forward, each recovered state reproduces the full 160-bit seed. For P-256, the published seed was candidate 1842 from one run of the generator.

What the evidence shows

The evidence here is unusually strong, for one reason: the output checks itself. Anthropic published two Python scripts that regenerate the seeds. Valsorda, who doesn't work for Anthropic, wrote that he "reimplemented the algorithm in Go to verify the claim." A 48-bit state that reproduces 160 bits exactly is not a coincidence anyone could talk themselves into. So the method is established for all five prime curves. The post also covers four binary curves and six base points, which it traces to a library called FreeLIP. What's left open is narrower than the headlines suggest, but it's real. The B-163 seed was not recovered. Neither was the method behind four of the main base points, P-256's among them. And there was a selection step nobody has explained. The post says the P-256 run skipped an earlier viable candidate, number 876. Valsorda notes that roughly twice as many valid seeds exist as were published. That points to rejection rules nobody wrote down. Then there's intent. Anthropic says the findings make a backdoor "much less plausible" and calls the whole thing "a fun closing chapter." That is a lab reading its own result. Valsorda's independent argument is sharper. The method left the NSA "barely 30 bits of freedom," not enough to target a rare class of weak curves. That's a strong argument about room to manoeuvre. It is not proof of motive, and the post itself concedes that deliberately picking timestamps remains conceivable in theory.

How people read it

On security, the evidence is lopsided. Both Anthropic and Valsorda read it as closing the case for practical purposes, and we haven't found a serious counter-reading for the prime curves. The leftover doubt sits with the binary curves. As Valsorda put it, "no one uses those, so who cares." The real disagreement is about what this says about AI. The AGI-forward reading: a model, without being pointed at the old rumour, reframed a problem people had failed at for years and solved it in under half an hour. The AI-realist reading: every technique was textbook. A bit-pattern scan, a brute force over 2¹⁷ values, a standard lattice algorithm. The hard part was the guess. That's valuable, but it's taste in picking hypotheses, plus speed, not new mathematics. Both readings fit the facts. One caution applies to both. The half-hour figure is Anthropic's own, and we don't know how many prompts, retries or human nudges surrounded it.

What it means for builders and investors

Our read: this is a clean template for AI doing forensic work, and the template matters more than the trivia. The claim earned trust not because a lab announced it, but because anyone could rerun it, and an expert with no stake did. That is a different trust model from a benchmark score. For builders, it points to a wedge: legacy systems, old binaries and undocumented formats, where an answer can be regenerated or tested. Value lands where checking is cheap. For investors, it offers a filter for announcements that AI discovered something. One question worth exploring in diligence might be this. Does the discovery come with an artifact a third party can rerun, and has someone without a stake actually done so? If yes, the open questions become cost and repeatability. If no, what you have is a claim about a result, not a result.

What to watch

Three things would settle the open parts. First, whether anyone recovers the B-163 seed, or shows it came from some other process. Second, whether the rejection rules behind skipped candidates like 876 ever surface, perhaps from old archives. Third, on the AI question, whether Anthropic publishes the full working session, so outsiders can see how much came from the model and how much from the setup. None of these has a date, and the first two may never close.