On October 16, 2026, Anthropic published "Claude reveals ECDSA curve origins," reporting that an internal research model identified how the seeds behind the standard NIST elliptic curves were produced, in under half an hour. The seeds had been unexplained since NIST adopted ECDSA in 2000 in FIPS 186-2. The finding is notable for the cryptography and also as a case study in how AI-assisted research handles an old puzzle. The authors are explicit that it is not an attack: it narrows a historical question and does not change the security of the curves.
AnthropicWhy the seeds mattered
ECDSA is among the most widely deployed signature schemes. The standard curves have a coefficient called b that is derived from a seed value, and the seeds were supplied by the NSA with no explanation. For decades that gap fed speculation that the seeds might hide a weakness. A 2015 tip claimed that Jerry Solinas had produced the seeds by hashing a humorous passphrase; Anthropic says that claim was wrong. A public bounty for finding the seeds' origin was organized by Filippo Valsorda.
The method
Searches built around the rumored passphrase found nothing. According to Anthropic, Claude instead guessed that the seeds came from a weak 1990s pseudo-random generator and wrote a scanner for output patterns across 34 generator and slice combinations. It noticed that the top bit of the 32-bit words was zero for four seeds, a pattern the C library function lrand48 produces, and recovered the hidden 17 bits by brute force over 2^17 values. For the prime-curve seeds, which keep fewer bits per output, it recovered the generator state with LLL lattice reduction on the lrand48 output shifted right by 23 bits.
The recovered states led back to srand48 initializations with Unix timestamps between May 1997 and April 1998 for the prime curves. The seeds are not hash outputs; each is built from successive 20-byte candidates. The four binary curves mapped to February 1984 when the timestamp was read directly. Doubling the timestamps gives April 17, 1998, so the program may have halved the clock, which the authors describe as a hypothesis.
What is explained and what is not
What the analysis explains, and what it does not
Summarized from Anthropic's write-up. The authors state this is not a cryptographic break.
The analysis also covers base points. The base point for P-192 and for five ANSI X9.62 example curves traces to the random number generator in FreeLIP, an arithmetic package by Arjen Lenstra, whose early NTL versions shipped the same code. The base points for P-224, P-256, P-384 and P-521, and for the NIST binary curves, are not explained by this method, and the seed for binary curve B-163 is also unexplained.
Why this is not a break
This is not a cryptographic break, new attack, or weakness in the ECDSA curves.
Anthropic
Anthropic's own takeaway is that there is no action to take. Its argument is that a weak, timestamp-seeded generator is an odd way to hide a backdoor, which makes a backdoor less plausible. The authors add limits: some viable candidates were skipped (for P-256, candidate 876 would also yield a valid curve), the selection criteria are unknown, and they cannot determine how many generation runs occurred. Plausibility is not proof, and the post does not claim otherwise.
What it shows about AI-assisted research
Three features stand out. The path was hypothesis-driven, since the model abandoned the popular story and tested a different class of explanation. It combined cheap search (a pattern scan) with heavier mathematics (lattice reduction). And it is checkable: the post includes Python code under CC0 that regenerates the seeds and selected base points, with output matching the published values. Reproducible code is what separates a credible AI-assisted result from a claim.
A caution applies in the other direction. This is a single, favorable case with a clear answer to verify, and it comes from the lab that built the model. Open problems without a checkable answer are harder. For researchers comparing how different models handle this kind of investigation, running the same question across several models, as multi-model tools like Metir allow, is a straightforward way to see whether the behavior is general or specific to one system.
The measured summary: an AI-assisted analysis explains the seed origins of most NIST curves as outputs of a 1990s generator, leaves several base points and one seed unexplained, and its authors say it neither breaks nor weakens the curves.
Sources:
Image credits
Header and in-body image: NIST campus aerial 2019, by Antony-22, Wikimedia Commons, CC BY-SA 4.0 (source).