The NIST prime curves — P-256, P-384, P-521, and a handful of others — underpin most of the TLS traffic on the internet. Their seeds were generated by Jerry Solinas at the NSA in 1997 and 1998, handed to NIST, and published without explanation. For nearly three decades nobody knew where the numbers came from, and after the Dual EC DRBG affair exposed a deliberate NSA backdoor in a NIST standard, not knowing the provenance of the curve seeds felt uncomfortable. In 2023, cryptographer Filippo Valsorda put up a $36,864 bounty for whoever could trace them.
Solinas died in early 2023, taking whatever he remembered with him. Human researchers tried and failed. The question stayed open.
Then an Anthropic employee handed Claude the seeds — no context, no clues — and asked it to figure out how they were generated. Claude came back in under half an hour.
What it found
The seeds are outputs of lrand48, a 48-bit linear congruential generator from the C standard library. The generator uses a fixed multiplier and addend, outputs the top 31 bits of its 48-bit state, and was common in 1990s Unix code. Claude noticed a pattern that’s easy to miss unless you’re looking for it: many of the curve seeds have their top bits set to zero. That’s a characteristic signature — lrand48 returns a 31-bit value packed into a 32-bit integer, so the high bit is always zero.
From there, the recovery is a worked-out technique. For the binary curves (B-233, B-283, etc.), brute-forcing the seed state is tractable. For the prime curves, whose seeds are 160 bits and require multiple generator outputs, the approach is lattice reduction: collecting several 31-bit outputs constrains the 48-bit hidden state, and the LLL algorithm recovers it efficiently. Working backward from the recovered state gives the Unix timestamp used to seed the generator — timestamps from 1997 and 1998, consistent with when Solinas would have been doing this work.
Claude also traced the base points for P-192 and several ANSI X9.62 curves to a different generator, FreeLIP. That’s a separate find embedded in the same session.
What it means
This is not a cryptographic break. The curves are not weakened. The finding doesn’t reveal a backdoor — it reveals the absence of one. If the seeds had been chosen to exploit some structural weakness in the curves, you’d expect them to look deliberate and specific. Instead they’re the output of a weak PRNG seeded with wall-clock time, exactly what an engineer in 1997 would reach for to generate “random-looking” numbers without deep ceremony. The curves appear to be exactly what they were always claimed to be: arbitrary choices made to satisfy mathematical generation criteria.
The backdoor suspicion was always a hypothesis that something specific and adversarial must explain the seeds. lrand48 plus a Unix timestamp is the null hypothesis. It’s boring, and that’s the point.
Anthropic donated the $36,864 bounty to the Internet Security Research Group. A few things still remain open: the B-163 seed is unexplained, and the base points for P-224, P-256, P-384, and P-521 haven’t been traced yet.
The stranger part
The interesting thing here isn’t really the cryptography — it’s that an AI solved this through forensic pattern recognition on a 30-year-old artifact, in a domain that wasn’t part of any benchmark, on a task where human experts had tried and stopped.
lrand48 is not obscure exactly, but it’s also not the first thing a modern programmer reaches for when reasoning about 1990s PRNG usage. Claude noticed the structural signature in the bit patterns, hypothesized the generator, and worked through the math. The whole session lasted less than 30 minutes.
The question is what to make of that. The curves story has a satisfying ending: a long-standing uncertainty in cryptographic infrastructure resolves cleanly, and the answer turns out to be mundane rather than sinister. What’s less easy to file away is the observation that AI apparently now does this kind of historical forensics well — noticing structure in old artifacts, retrieving the right 1990s software context, and running the appropriate mathematical toolkit on the first try.