For more than two decades, cryptographers have wondered where a handful of mysterious numbers inside one of the internet’s most important security standards actually came from. Anthropic says its Claude AI model has finally solved the puzzle, tracing the origin of the “random” seed values used to build NIST’s elliptic curve standards. The discovery does not change how the curves work or reveal any weakness, but it closes a long-running trust gap that has shadowed the standard since the year 2000.
Why the ECDSA seeds mattered in the first place
ECDSA, the Elliptic Curve Digital Signature Algorithm, is one of the most widely used cryptographic standards in the world, securing everything from TLS connections to cryptocurrency wallets. It was adopted by the U.S. National Institute of Standards and Technology (NIST) in 2000 as part of the FIPS 186-2 Digital Signature Standard, which specifies a set of standard elliptic curves at different security levels.
Each curve is built using a “seed” value whose cryptographic hash determines a key coefficient of the curve’s equation. The problem: these seeds were handed to NIST by the NSA with no explanation of how they were chosen. For example, the seed for the widely used P-256 curve was simply the hexadecimal string C49D3608 86E70493 6A6678E1 139D26B7 819F7E90, with no documented provenance.
Because the NSA has a documented history of influencing cryptographic standards in ways that later proved to contain deliberate weaknesses (most notably the Dual_EC_DRBG scandal), the unexplained seeds fueled years of speculation that the curves might contain a hidden backdoor. Cryptographers Neal Koblitz and Alfred Menezes catalogued this controversy in a well-known paper, “A Riddle Wrapped in an Enigma,” and an informal bounty circulated for years among amateur researchers trying to crack the mystery.
A dead end, then a new lead from Claude
The most popular theory held that longtime NSA employee Jerry Solinas had generated the seeds by hashing a humorous passphrase. But after Solinas died in 2023, nobody could confirm the story, and former colleagues did not respond to inquiries. Anthropic researchers had themselves spent time chasing this passphrase theory without success.
The breakthrough came, according to Anthropic, in October 2026, when an employee asked an internal research model to independently figure out how the seeds were generated, without telling it about the passphrase rumor. Rather than searching for a hidden phrase, Claude reasoned about what kind of software would have been used to generate the seeds in the 1990s and guessed it was a pseudorandom number generator (PRNG) commonly bundled with C libraries of that era.
How Claude cracked the seed generation method
Old PRNGs like the C library’s lrand48 function are mathematically weak by modern standards, which means their output patterns can be recognized if you know what to look for. Claude wrote a scanner that slid along each published seed one bit at a time, testing for the telltale statistical fingerprint of known legacy PRNGs.
In under half an hour, Claude identified the source of the seeds for NIST’s P-192, P-224, P-256, P-384, and P-521 curves. None of them involved a hashed passphrase at all. Instead, each seed was the direct output of the lrand48 generator, initialized with a Unix timestamp.
The process worked like this: the generator, seeded by a specific timestamp, would be run for a number of iterations, with each iteration producing 20 bytes as a candidate seed value. The first 20 bytes formed candidate one, the next 20 formed candidate two, and so on, until a candidate matched the published standard. For the P-256 curve specifically, Anthropic says it took 1,842 iterations to produce the seed that NIST eventually standardized.
Why this is good news rather than a security scare
It’s worth being clear about what this finding is not: it is not a cryptographic break, a new attack, or evidence of a weakness in ECDSA itself. The security of the NIST curves is unaffected.
What it does accomplish is removing the ambiguity that made backdoor theories plausible in the first place. A process involving a simple, publicly known random-number generator seeded by a timestamp is the opposite of a hidden, manipulable process. Anyone can now reproduce the method. Anthropic argues this makes it far less likely that the NSA engineered the curve parameters to include a secret vulnerability, since doing so through this mechanical, time-based process would have left little room for deliberate tampering.
As Anthropic’s researchers put it, most cryptographers already trusted these curves despite the unexplained seeds, since no mathematical weaknesses have ever been found in them. This result does not change that practical trust calculus; it simply replaces decades of educated guesswork with a documented, verifiable explanation.
What developers and security teams should actually do
For working developers, the short answer is: nothing changes. ECDSA implementations, TLS libraries, and systems relying on the NIST curves do not need any updates, patches, or reconfiguration as a result of this finding. Anthropic’s own framing is explicit that this is “a fun closing chapter” to a historical mystery rather than an actionable security advisory.
The broader interest here is less about immediate security practice and more about two things: a satisfying resolution to one of applied cryptography’s oldest open questions, and a notable demonstration of an AI model performing original detective-style research, forming a hypothesis about 1990s-era software engineering practices, building a custom analysis tool, and validating it against historical data without being pointed toward the answer.
Frequently asked questions
Does this mean ECDSA curves are now proven safe?
It strengthens confidence by ruling out one specific backdoor theory, but curve security has always rested primarily on decades of mathematical analysis finding no weaknesses, not on the seed mystery.
Should I change any cryptographic configurations because of this?
No. Anthropic explicitly states there is no action for developers or organizations to take; existing ECDSA deployments remain unaffected.
What was wrong with the old “humorous passphrase” theory?
It was a widely circulated rumor attributed to NSA employee Jerry Solinas, but searches based on it never produced a match, and Claude’s investigation showed the actual method involved a timestamp-seeded PRNG instead.
답글 남기기