The artificial intelligence Claude, developed by Anthropic, took just 30 minutes of work to determine how the U.S. National Security Agency (NSA) generated the initial data—known as seeds—for five popular elliptic curves embedded in the NIST digital signature standard. The mystery that cryptographers had wrestled with for a quarter of a century concerned the FIPS 186-2 standard adopted in 2000: it used published starting numbers for the curves, but their exact origin remained unknown, fueling suspicions for years about potential hidden vulnerabilities.
Why the Origin of the Seeds Was a Mystery
Elliptic curves form the foundation of the ECDSA digital signature algorithm, which is still used to protect data worldwide today. To construct such curves, starting numbers must be specified, and their generation by the NSA was never documented. For decades, the dominant theory was that the seeds might be hashes of humorous English phrases, while some experts suspected the intelligence agency deliberately chose parameters to leave a "backdoor" for surveillance. Neither hypothesis was confirmed or denied until the Claude model took on the task.
The Model's Approach: Through the Eyes of a 1990s Programmer
Instead of brute-forcing random English phrases, Claude analyzed software used in the 1990s and checked 34 combinations of generators and data fragments. The model determined that the initial values were generated using a standard C pseudo-random number generator tied to Unix system timestamps, discovering a link between the parameters of five curves—P-192, P-224, P-256, P-384, and P-521—and the outdated lrand48 generator used in 1990s C libraries.
Math Versus Brute-Forcing Phrases
For binary curves, the model identified a characteristic pattern: the first bits of the numbers were systematically zero, matching the 31-bit output of the lrand48 generator. For more complex curves, Claude applied the Lenstra–Lenstra–Lovász (LLL) algorithm, which detects hidden patterns in sets of numbers. As a result, the model established that the initial values were generated between May 1997 and April 1998; for instance, the required value for the P-256 curve was found in a sequence launched on August 16, 1997.
Historical Reconstruction, Not a Hack
Anthropic emphasizes that the discovery is a "historical reconstruction, not a cryptographic break." The research does not reveal private keys and creates no new threats to the ECDSA digital signature algorithm. Reproducing the mathematical logic applied by the NSA reduces rather than increases concerns about intentional backdoors in standards: the shown connection to a standard 1990s generator does not point to a deliberate tuning of parameters for a hidden vulnerability.
Reward and Industry Significance
For this discovery, Anthropic received a $36,864 charitable reward organized by cryptographer Filippo Valsorda; all funds were donated to the Internet Security Research Group. The case demonstrates that modern language models are capable not only of generating code but also of performing informal cryptoanalysis, restoring lost documentation and resolving long-standing research questions previously thought unsolvable without exhausting a vast space of hypotheses.
