Claude Traces NIST Curve Seeds to a 1990s C Library
Claude traced ten NIST and ANSI X9.62 curve seeds to lrand48 outputs seeded by Unix timestamps, making deliberate weakness less plausible, though selection criteria and several base points remain unexplained.
Anthropic researchers report that an internal Claude model recovered the origins of five NIST prime-curve seeds in under half an hour, and five ANSI X9.62 seeds show the same pattern. The seeds were not passphrase hashes, as a 2015 tip suggested, but outputs of the C library lrand48 generator initialized with Unix timestamps between May 1997 and April 1998.Claude recognized the generator from zero top bits, recovered truncated states with lattice reduction, and reproduced each 160-bit seed, matching six base points to FreeLIP seeds. The work does not demonstrate a cryptographic break, and Anthropic says it makes deliberate backdoors less plausible. The P-224, P-256, P-384 and P-521 base points, the B-163 seed, and the criteria for skipping viable candidates remain unexplained.
The bits that matter
- NIST adopted ECDSA in FIPS 186-2 in 2000 with seeds supplied by the NSA and no explanation, prompting years of suspicion and a bounty organized by Filippo Valsorda.
- Claude scanned 34 generator/output combinations, spotted zero top bits across four seeds (chance 1/5810), identified lrand48 returning the top 31 bits of a 48-bit state, and used LLL to recover truncated states.
- The published code reproduces each seed from a timestamp and iteration count; P-256's seed is candidate 1842 from 1997-08-16 01:52:34, while binary-curve initializations read as February 1984, which double to April 1998, suggesting the program may have halved the clock.
- Six May 1997 base points match FreeLIP generator seeds 20000, 20420, 20507, 20509, 20512 and 20517; the base points for P-224, P-256, P-384 and P-521 remain unexplained.
- Open questions include skipped viable candidates, such as P-256 candidate 876, and the unrecovered B-163 seed; the $36,864 bounty will go to the Internet Security Research Group.
Discussion analysis
Analysis details
27 comments analyzed. Analyzed .
The sample selects active discussion branches and includes available parent comments. It may omit parts of the full thread. The analysis included 27 of 37 usable stored comments because of the input limit. Selected themes do not measure community opinion or how common a view is.
Open models as counterweight to gated access
Anthropic can run internal research with Claude while public users may face cyber safeguards, widening a moat between model providers, government partners and the public. Open weights and distillation are proposed as the only bridge. Some report cryptography work was not blocked, but the broader concern is concentration of research capability.
Cyber filters restrict legitimate research
Security safeguards are described as blocking basic work, with verified researchers granted better access than individuals or small startups. The rationale is liability and public relations: if a model helps find a backdoor or harmful recipe, the lab faces lawsuits and bad PR. The restrictions push some users toward open models.
Selection criteria remain unproven
The recovered RNG method explains production but not selection. Discarded candidates are invisible, and the claim that a timestamp search would require disclosure does not follow because doing and saying nothing would suffice. The result narrows the backdoor question without closing it.
Credit for human researchers
The model cannot identify which trained papers informed the solution, so unlisted researchers may have contributed without recognition. Others argue the main contribution is Claude's solution, and prior work may already have covered the same ground. Attribution remains uncertain.
Human source story corrected
Jerry Solinas and Bob Reiter were identified as the two people involved, and Solinas's 2015 email to Daniel Bernstein described the seed as a hash of a passphrase, an account four people including two ex-NSA sources reportedly corroborated before the recovered RNG output showed it wrong. Bob Reiter never responded.
Commercial incentives and liability
Restricting access is framed as liability management: if a model helps with harmful instructions, the lab faces lawsuits and bad PR. AI valuations are tied to replacing industries, while handmade goods retain a premium, and regulation could separate model creation from hosting.