Anthropic: Claude Traced NIST ECDSA Seeds to Unix Timestamps

"It's just timestamps," reads the opening of Anthropic's research post, which says that in under half an hour, Claude discovered that the long-mysterious seeds behind the NIST P-192 through P-521 elliptic curves came from the C library's lrand48 random-number generator, seeded with a Unix timestamp.

The specifics are deadpan. P-256's standardized seed took 1,842 iterations of the generator starting from a Unix clock reading of August 16, 1997, 01:52:34. P-192's took 139 iterations from May 18, 1997. Base points for six of the curves trace to the random number generator in FreeLIP, with seeds Claude pinned to "20000 for P-192, 20420, 20507 and 20509 for prime239v1 to v3, and 20512 and 20517 for prime192v2 and v3."

Anthropic frames this as a confidence-building result, not a scare. "This is not a cryptographic break, new attack, or weakness in the ECDSA curves," the post says. "The seeds were generated in a very simple way: a common pseudorandom number generator initialized from the clock, which anyone can now reproduce." The claim is that reproducibility leaves "much less room for subversion and that we can be confident the parameters are secure."

Not everything is explained.

The B-163 seed "fits nothing Claude has tried and remains unexplained," and the post also concedes "we don't know how the base points for P-224, P-256, P-384, and P-521 were generated." A fragment of recollection the post includes from the late Jerry Solinas reads: "I believe there was a counter rather than multiple hashing, but I don't know details. The message was along the lines of 'Give Bob and Jerry a raise' or 'Bob and Jerry rule' or something like that."

The post adds that the $36,864 bounty "for finding the seeds will be donated to the Internet Security Research Group." It lands amid a dense run of Anthropic research coverage we've tracked this quarter.