NIST elliptic-curve seeds traced to a 1990s C random number generator seeded with the clock
An Anthropic model showed that the published seeds of the NIST prime curves P-192, P-224, P-256, P-384 and P-521 and five ANSI X9.62 example curves are outputs of the C library's lrand48 generator seeded with Unix timestamps from May 1997 to April 1998, not hashes of a secret phrase, answering the origin question behind a long-standing backdoor debate.
- Lab
- Anthropic
- Model
- Internal Anthropic research model (Claude), not named in the announcement
- Field
- Computer science
- Date
- 2026-10-16
- Human collaborators
- John Wood, Henry de Valence, Ava Howell, Zack Voase, Lucy Sweet, Amir Omidi, Paul Crowley, Iain McGinniss, Nicholas Carlini, Steve Weis
Sources
Announcement
Independent commentary
What was found
The NIST curves standardised around 2000 were said to be generated verifiably at random from SHA-1 hashes of seeds, but the seeds themselves were unexplained, which fed long-running suspicion that they had been chosen to target weak curves; Jerry Solinas's recollection that they came from hashing a humorous phrase was never confirmed, and in 2023 Filippo Valsorda offered a bounty for an explanation. The announcement says an employee asked an internal research model to work out how the seeds were generated, without the phrase clue, and that it identified lrand48 in under half an hour. Each prime-curve seed is a run of lrand48 outputs shifted right by 23 bits from a generator seeded with a 1997 or 1998 timestamp: P-256's is the 1,842nd 20-byte candidate of a run started at 01:52:34 UTC on 16 August 1997. Four binary-curve seeds fit lrand48 seeded with half the timestamp, and the base points of P-192 and five X9.62 curves come from the random number generator of Arjen Lenstra's FreeLIP library.
Novelty check
The question was open: Valsorda's bounty, announced in July 2023, stood unclaimed until the Anthropic team claimed it on 15 October 2026. Valsorda's post confirming the result says the seeds were the output of the drand48 family seeded with the time, not the hash of a sentence.
Caveats and known objections
Entered at claimed under the rule that lab announcements start there, not out of doubt about the computation: the claim is an exact calculation anyone can rerun, and it has been rerun independently twice, by Valsorda in Go and here with the system C library, so it is a candidate for formal. A chance match of five 160-bit values from a search over about a year of timestamps is not a live possibility. Not explained: the B-163 seed, the base points of P-224 through P-521 and of the binary curves, why some valid candidates were skipped, and how many runs there were; Valsorda notes roughly twice as many valid seeds exist as were published and that one acceptance criterion still escapes them. The account of how the result was found rests on Anthropic alone: the model is internal and unnamed, ten staff are credited with the work, and Valsorda's post credits the team without mentioning a model, which is why autonomy is ai-led rather than autonomous. This is not a cryptographic break; Valsorda concludes the process left its operator barely 30 bits of freedom, too few to target a weak class of curves. The Hacker News thread on the announcement adds two things to Valsorda's post. Valsorda himself puts the operator's freedom at roughly 30 bits under stated assumptions and cites Koblitz and Menezes (eprint 2015/1018, section 3.1), who argued that the selection concern was already implausible at 160 bits. A commenter, cyphar, notes that almost all of the lower candidate indices were not valid curve values at all, so the search was for valid seeds rather than for chosen ones, and that about half of the valid seeds were nonetheless discarded for reasons still unknown, with a buggy validity check the suggested explanation. Neither is an objection to the lrand48 finding.
Independent checks
Filippo Valsorda (bounty organiser, reimplementation in Go): Reimplemented the generation in Go and confirmed the claim; concludes that it rules out the hash-targeting technique proposed by Bernstein and Lange, leaving barely 30 bits of freedom. · link ↗
whataifound.org (recomputation with the system C library): Seeding the macOS C library's srand48 with each stated timestamp and taking lrand48 outputs shifted right by 23 bits reproduced the SEED values of P-192, P-224, P-256, P-384 and P-521 as printed in FIPS 186-4, byte for byte, at the stated candidate indices. · link ↗
Disagree with these grades?
Bring a citation: a grade moves on evidence, not on argument.
Or on GitHub: submit a check challenge the grade send a correction or send a pull request
Flag this for triage
Signals order the review queue and nothing else. They are never published, and they never move a grade: that takes a citation.
Entry history (1 event)
- AddedEntered the registry graded Claimed and AI-led.
Entries are never deleted. A grade that does not hold up is downgraded on the record, with the reason beside it.
Community discussion
Graded claimed for verification and ai-led for autonomy. What these mean.
Cite this entry
whataifound.org. (2026). NIST elliptic-curve seeds traced to a 1990s C random number generator seeded with the clock. whataifound.org: A Registry of AI Scientific and Mathematical Discoveries. https://whataifound.org/finding/2026-10-16-nist-curve-seeds-lrand48BibTeX
@misc{whataifound-anthropic-2026-lrand48,
title = {NIST elliptic-curve seeds traced to a 1990s C random number generator seeded with the clock},
author = {{whataifound.org}},
year = {2026},
howpublished = {whataifound.org: A Registry of AI Scientific and Mathematical Discoveries},
note = {Result by Anthropic. Verification: Claimed. Autonomy: AI-led.},
url = {https://whataifound.org/finding/2026-10-16-nist-curve-seeds-lrand48}
}