News · 2026-10-17

Claude traced NIST curve seeds to a 1997 clock, and a cryptographer reproduced the result

Anthropic says an internal Claude research model recovered how five widely used American cryptographic curve seeds were generated, and cryptographer Filippo Valsorda independently reproduced the recipe. The result replaces a long-standing mystery with a timestamp-based procedure. It adds evidence about the parameters' origins without revealing a cryptographic weakness or requiring users to change anything.

Key facts

• Five NIST prime-curve seeds match a standard 1990s pseudorandom generator initialized from clock time.
• Valsorda records the bounty claim on October 15, 2026; the charitable award was $36,864.
• Anthropic credits an unnamed internal Claude model with finding the recipe in under half an hour.
• Primary sources are Anthropic's research account and Valsorda's independent reproduction.

A cryptographic seed is a starting value used to construct a mathematical object. In this case, the objects are elliptic curves used in digital signatures. Publishing a seed lets other people repeat later construction steps. But an unexplained seed leaves an earlier question unanswered: why was this starting value chosen?

That question matters because standards can embed choices that are difficult for outsiders to audit. If a designer could search enormous numbers of candidates and select a secretly weak one, reproducibility from the published seed would not reveal the manipulation. The old uncertainty concerned the origin of the seed itself, rather than a demonstrated way to break signatures.

Anthropic's account and reproduction code identify the C-library generator lrand48, initialized through srand48() using a Unix timestamp. It generated successive 20-byte candidate seeds, which were tested under the established curve-generation procedure. For P-256, the published seed is candidate 1,842 from a run starting at 01:52:34 UTC on August 16, 1997.

Think of finding an old lottery ticket and reconstructing the shop's ticket printer. Matching the printer, its initial setting and the ticket's position in the roll explains far more than merely reading the number printed on the ticket. It still does not prove why the operator kept one ticket and discarded another.

That last distinction is central to the result. Anthropic also reports matching patterns for five ANSI prime-curve seeds and recovering apparent time initializations for four NIST binary-curve seeds. One binary seed, B-163, remains unexplained. Several base-point origins also remain open. A seed used to define a curve coefficient and the point used as a signing reference are separate historical questions.

Valsorda's contribution strengthens the evidence substantially. In his independent Go implementation and audit, the bounty organizer reproduced the published seeds rather than accepting the model's assertion that its code worked. He calls the result a “rehabilitation arc” for the curves. His analysis argues that the recovered process leaves too little search freedom for a particular proposed weak-curve selection strategy.

There is a serious remaining caveat. Some candidate seeds appear to produce viable curves but were skipped. Valsorda identifies an additional rejection criterion, yet the remaining filtering is still incompletely explained. Reconstructing a procedure that fits the published values is strong provenance evidence; it does not recover the original program or settle every selection decision.

The artificial-intelligence attribution has its own boundary. Anthropic says an employee gave an internal research model an open-ended question, without supplying the rumored passphrase clue. The company describes hypothesis formation, scanner construction and recovery of generator state. It does not publish the model identity, full interaction, tool budget or complete record of subsequent human steering. Readers cannot infer that a publicly available Claude version would repeat the discovery unaided.

The Hacker News discussion includes both enthusiasm and technically substantive skepticism about discarded candidates. Matthew Green's comments address how large a weak class of curves would need to be for the recovered search to encounter one. Those are individual expert reactions, rather than a vote establishing mathematical certainty.

The distinction between a reproduced calculation and a complete historical account is useful beyond cryptography. Matching public outputs gives outsiders a testable claim, while missing records still limit what can be said about the original human decisions.

Under the original bounty terms, the charitable option tripled the award; Anthropic's team directed it to the Internet Security Research Group. The operational consequence remains straightforward: the curve parameters have not changed, and no browser patch follows from this discovery. The broader lesson is about evidence. An AI-generated historical explanation becomes much more persuasive when another person implements the recipe independently and exposes what remains unresolved.

Primary source, verified: read the paper →

Ground Truth. (2026, October 17). Claude traced NIST curve seeds to a 1997 clock, and a cryptographer reproduced the result. Ground Truth. https://groundtruth.day/news/claude-recovers-nist-curve-seed-origins.html

@misc{groundtruth:claude-recovers-nist-curve-seed-origins,
  title  = {Claude traced NIST curve seeds to a 1997 clock, and a cryptographer reproduced the result},
  author = {{Ground Truth}},
  year   = {2026},
  month  = {oct},
  url    = {https://groundtruth.day/news/claude-recovers-nist-curve-seed-origins.html}
}

Topics: cybersecurity · ai-security · cryptography · ai-discovery