Anthropic: Claude Traced NIST ECDSA Seeds to Unix Timestamps
TL;DR
- Claude used lattice reduction on truncated lrand48 states to recover nine NIST prime-curve seeds, each tracing to a Unix timestamp between May 1997 and April 1998.
- P-256's seed required 1,842 lrand48 iterations from a timestamp of August 16, 1997, a fully reproducible result from Anthropic's published code.
- Filippo Valsorda independently reimplemented the solution in Go, confirmed the match, and donated the tripled $36,864 bounty to ISRG.
"It's just timestamps," reads the opening of Anthropic's research post, which says that in under half an hour, Claude discovered that the long-mysterious seeds behind the NIST P-192 through P-521 elliptic curves came from the C library's lrand48 random-number generator, seeded with a Unix timestamp.
The specifics are deadpan. P-256's standardized seed took 1,842 iterations of the generator starting from a Unix clock reading of August 16, 1997, 01:52:34. P-192's took 139 iterations from May 18, 1997. Base points for six of the curves trace to the random number generator in FreeLIP, with seeds Claude pinned to "20000 for P-192, 20420, 20507 and 20509 for prime239v1 to v3, and 20512 and 20517 for prime192v2 and v3."
Anthropic frames this as a confidence-building result, not a scare. "This is not a cryptographic break, new attack, or weakness in the ECDSA curves," the post says. "The seeds were generated in a very simple way: a common pseudorandom number generator initialized from the clock, which anyone can now reproduce." The claim is that reproducibility leaves "much less room for subversion and that we can be confident the parameters are secure."
Not everything is explained.
The B-163 seed "fits nothing Claude has tried and remains unexplained," and the post also concedes "we don't know how the base points for P-224, P-256, P-384, and P-521 were generated." A fragment of recollection the post includes from the late Jerry Solinas reads: "I believe there was a counter rather than multiple hashing, but I don't know details. The message was along the lines of 'Give Bob and Jerry a raise' or 'Bob and Jerry rule' or something like that."
The post adds that the $36,864 bounty "for finding the seeds will be donated to the Internet Security Research Group." It lands amid a dense run of Anthropic research coverage we've tracked this quarter.
What others are reporting
-
Unite.AI Read →
Frames the discovery around the human narrative: Solinas's death in 2023, the failed humorous-passphrase lead, and the bounty system; covers remaining open questions on base points.
Claude identified the origins of the NIST P-192, P-224, P-256, P-384, and P-521 seeds: outputs of the C library's lrand48
-
CellCog Read →
Independently ran Anthropic's published code and confirmed all nine seeds match FIPS 186-2 character-for-character; a control run stopping one candidate early does not match.
This is not a cryptographic break, new attack, or weakness in the ECDSA curves.
-
DEV Community Read →
Pivots to developer-facing implications: git grep patterns and code examples in Python, Node.js, and Go to audit codebases for weak randomness in security-sensitive contexts.
The seeds behind P-256, the curve under every ES256 signature on a JWT, were not the hash of a secret NSA sentence.
-
ExplainX.AI Read →
Includes a reproducible 15-line Python script and flags that a pre-timestamp-enumeration backdoor remains theoretically non-falsified; base points of most deployed curves still unexplained.
The seeds for the standard ECDSA curves were produced by the C library generator lrand48, seeded with a Unix timestamp, rather than by hashing a memorable phrase.
-
Mad Robot Read →
Provides Solinas's 2015 statement about a joke phrase and frames Valsorda's $36,864 donation to ISRG as the community validation event closing the bounty.
"The message was along the lines of 'Give Bob and Jerry a raise' or something like that." -- Jerry Solinas, NSA mathematician
Originally reported by anthropic.com
Read the original article →Original headline: Anthropic Says Claude Cracked NIST ECDSA Curve Seed Mystery in 30 Minutes, Traces Seeds to lrand48 Plus Unix Timestamps