Anthropic’s Claude AI model has solved a 25-year-old cryptographic mystery by tracing the origins of five elliptic-curve seeds supplied by the US National Security Agency and adopted by NIST in 2000. The research, published October 16, found that the unexplained P-192, P-224, P-256, P-384 and P-521 seeds were generated using lrand48, an older C programming library pseudorandom-number generator, initialized with ordinary Unix timestamps from 1997 and 1998.
Claude reportedly completed the investigation in under 30 minutes. For the P-256 curve, it reproduced the published seed at the 1,842nd candidate in a sequence initialized on August 16, 1997. The model identified patterns in the generator’s output and reconstructed its internal state, while cryptography engineer Filippo Valsorda independently reproduced the method. A $36,864 charitable bounty will go to the Internet Security Research Group, which operates Let’s Encrypt.
The result reduces long-running speculation that the NSA may have selected parameters with hidden weaknesses. However, researchers could not explain the selection of several base points, the seed for the B-163 binary curve, or why some mathematically acceptable candidates were skipped.
Bitcoin and Ethereum do not use the disputed NIST curves. Both rely on secp256k1, chosen by Satoshi Nakamoto with simpler parameters. Coinbase wallet lead Pete Kim said the choice was likely influenced by fear of an NSA backdoor, adding that there is no backdoor after all. Ledger co-founder Nicolas Bacca joked ‘Checkmate Satoshi,’ while Blockstream CEO Adam Back said the fault lay with the NSA for not revealing how the curves were generated.
The research does not identify any weakness in Bitcoin or Ethereum signature mathematics, and does not allow private key recovery. It also does not remove the longer-term threat of quantum computing, which could theoretically attack elliptic-curve keys if sufficiently powerful machines emerge. NIST finalized its first post-quantum standards in August 2024, but Bitcoin’s transition would require broader network agreement.
