Claude finds NIST ECDSA curve seeds came from Unix timestamps

You do not need to change anything because of this post. Anthropic's spoiler is explicit: "There is no action to be taken or things to do differently." Anthropic also published code anyone can run to regenerate the seeds.

What changed#

On Oct 16, Anthropic published Claude reveals ECDSA curve origins. An internal research model, asked without the old "humorous phrase" tip, recovered the NIST P-192, P-224, P-256, P-384 and P-521 seeds "in under half an hour."

They were not hashes of a forgotten passphrase. They were output of the C library's lrand48 PRNG, seeded with Unix timestamps. For P-256, the published seed C49D3608 86E70493 6A6678E1 139D26B7 819F7E90 is candidate 1842 from a run at 1997-08-16 01:52:34. The ten prime-curve seeds map to timestamps between May 1997 and April 1998.

Anthropic says the base points of six May 1997 curves (P-192 and five ANSI X9.62 examples) come from the random number generator in FreeLIP. The base points of P-224, P-256, P-384 and P-521, and the B-163 seed, stay unexplained.

Why it matters#

ECDSA is one of the most widely used signature standards. The NSA handed NIST the seeds with no provenance, which fed years of backdoor speculation. Anthropic says this finding "is not a cryptographic break, new attack, or weakness" and instead "makes [deliberate backdoors] much less plausible," because anyone can now regenerate the seeds from a common 1990s PRNG and a clock.

Filippo Valsorda, who organized the public bounty, verified the claim in Go and wrote that the result "completely rule[s] out" the Bernstein/Lange technique that needed about 70 bits of seed freedom. He says he would now personally recommend the NIST curves over Curve25519. The $36,864 bounty is being donated to the Internet Security Research Group (ISRG / Let's Encrypt).

How to use it#

1. Do not rip out P-256. Anthropic says "There is no action to be taken." Our read: treat this as history closed, not an incident response ticket.
2. Optional (our suggestion): check the P-256 line with Anthropic's reproduce code, which the page dedicates to the public domain under CC0. This is our trim of it to P-256 only; we have not tested it for you:

# trimmed by us from Anthropic's CC0 code (ecdsa-curve-origins); P-256 only
from datetime import datetime, timezone
def unix(when):
    return int(datetime.fromisoformat(when).replace(tzinfo=timezone.utc).timestamp())
def candidate(t, n, per, shift, width):
    x, out = (t << 16) | 0x330E, ""
    for i in range(per * n):
        x = (0x5DEECE66D * x + 0xB) % 2**48
        if i >= per * (n - 1):
            out += "%0*X" % (width, x >> shift)
    return out
print(candidate(unix("1997-08-16 01:52:34"), 1842, 20, 40, 2))
# expect: C49D360886E704936A6678E1139D26B7819F7E90

3. Prompt (ours): ask a model to explain the claim without inventing a break:

Summarize Anthropic's Oct 16 ECDSA curve-origins post for a security team: what was found, what it is not (no break/attack), which seeds and timestamps match, which open questions remain (B-163, some base points), and whether we should change TLS or signing defaults. Quote the post; invent nothing.

Good to know#

• Open questions. B-163's seed is still unexplained. Base points for P-224, P-256, P-384 and P-521 (and NIST binary curves) are unexplained. Some viable candidate seeds were skipped; Anthropic writes "we do not believe it is plausible that weakened curves were selected."
• PRNG naming. Anthropic writes lrand48. Valsorda's writeup says drand48. Same POSIX 48-bit LCG family; quote each source's word rather than collapsing them.
• Bounty and authors. Claim filed Oct 15, 2026 at 01:07:51 UTC (9:07 PM ET Oct 14) per Valsorda; public Anthropic writeup dated Oct 16. Prize donated to ISRG. Work credited to John Wood, Henry de Valence, Ava Howell, Zack Voase, Lucy Sweet, Amir Omidi, Paul Crowley, Iain McGinniss, Nicholas Carlini and Steve Weis, with Jerry Solinas acknowledged posthumously.
• Companion research (same day, separate story): Designing more efficient quantum circuits with Claude, also posted on X at 1:47 PM ET.

Sources#

• https://www.anthropic.com/research/ecdsa-curve-origins (checked 2026-10-16 3:57 PM ET)
• https://words.filippo.io/seeds-solved/ (dated 16 Oct 2026; checked 3:58 PM ET)
• https://blockchain.news/news/claude-traces-origins-of-nist-ecdsa-curve-seeds (Peter Zhang, 2026-10-16 19:07 UTC; checked 3:58 PM ET)
• https://www.anthropic.com/research/designing-efficient-quantum-circuits (checked 3:58 PM ET)
• https://x.com/AnthropicAI/status/2111152183240511640 (posted 2026-10-16 1:47 PM ET; quantum companion; checked 3:59 PM ET)

Last checked: 2026-10-16