For roughly 25 years, cryptographers have puzzled over a small but unsettling gap in one of the internet’s most widely used signature standards. When the National Institute of Standards and Technology (NIST) formalized the Elliptic Curve Digital Signature Algorithm (ECDSA) in 2000, it published the random-looking “seed” values used to generate several standard curves — including P-256 and P-384, which still underpin HTTPS certificates, VPNs, and secure messaging today — but never explained where those seed numbers actually came from.

That silence fueled decades of suspicion. Without a documented origin, there was no way to rule out the possibility that the NSA, which helped shepherd the standard, had quietly selected curves with a hidden mathematical weakness only it knew how to exploit. According to a new report from Anthropic, an internal Claude model has now closed that gap, reconstructing exactly how the seeds were generated in under half an hour of automated analysis.

A Decades-Old Theory Gets Overturned

The leading explanation for years came from former NSA mathematician Jerry Solinas, who recalled that the seeds might trace back to hashed inside jokes, such as the phrase “Give Bob and Jerry a raise.” That folklore shaped how researchers approached the problem, pointing them toward hash-based explanations that never quite panned out.

Rather than chase that theory, Anthropic’s researchers set Claude loose on the raw seed values with a different hypothesis: that they came from an ordinary, if outdated, pseudorandom number generator common in 1990s-era software. The model built a scanner testing 34 different generator and output-slicing combinations against the published seeds, looking for structural fingerprints rather than semantic meaning.

How the Reconstruction Worked

The breakthrough came from a telling pattern: several binary-curve seeds had a zero in the same bit position across every 32-bit word, consistent with output from lrand48, a C library generator that only returns 31 of its 48 internal state bits. From there, Claude brute-forced the missing bits and verified them against later outputs in the sequence.

The prime-curve seeds, including those behind P-256 and P-384, were harder to crack because the generator retained just eight bits per output round. To recover the internal state from such sparse data, the model applied the Lenstra–Lenstra–Lovász (LLL) lattice-reduction algorithm — a technique more commonly associated with breaking weak cryptographic implementations than with historical forensics.

Running the reconstructed generator backward pointed to initialization timestamps clustered between May 1997 and April 1998. In the case of P-256, researchers traced the published seed to the 1,842nd candidate output from a generator run started on August 16, 1997. Four additional binary-curve seeds matched a related pattern tied to a halved clock value, though Anthropic described that specific link as a plausible interpretation rather than a confirmed fact.

What This Does — and Doesn’t — Mean for Security

Anthropic was careful to frame the finding narrowly. The curve seeds are public parameters used to define the mathematical structure of the standard, not private signing keys, and reconstructing their origin does not expose any secret key material or let an attacker forge signatures. No new weakness in ECDSA itself was identified, and the report explicitly calls for no changes to any deployed system as a result.

What the finding does offer is historical reassurance. A seed-generation process this mechanical and repeatable, researchers argue, is much harder to reconcile with deliberate, hidden manipulation than a process that left no reconstructable trail at all. The same technique also traced the separate “base point” values for several curves back to FreeLIP, an old long-integer arithmetic library, further filling in the standard’s murky early history.

• Five NIST seeds and five ANSI X9.62 example seeds were matched to the same 1990s-era generator process.
• The reconstruction used brute-force bit recovery combined with LLL lattice reduction on partial generator outputs.
• Anthropic published reproduction code so outside researchers can independently verify the matches.
• Gaps remain: the seed behind curve B-163 is still unexplained, and researchers found skipped candidate values with no documented reason for their rejection.

An Emerging Pattern for AI in Security Research

The project is the latest in a string of cases where AI models have been pointed at long-standing cryptographic or forensic puzzles rather than new exploit development. Anthropic says the Internet Security Research Group will receive a bug-bounty-style reward of $36,864 tied to the disclosure, underscoring that the organization treated the finding as a genuine security research contribution rather than a routine blog post.

For defenders, the practical takeaway is reassurance rather than urgency: widely deployed NIST curves have not been shown to contain a hidden backdoor, and the origin of their seed values is now far better documented than at any point since the standard was published. The unresolved pieces — B-163’s seed and the unexplained skipped candidates — mean the historical record still isn’t complete, but the central fear that has shadowed these curves for a generation has lost much of its footing.