VibeusClaude traced the origins of five NIST ECDSA curve seeds to a... - Vibeus
Claude traced the origins of five NIST ECDSA curve seeds to a timestamped random-number generator.
For years, the unexplained seeds used to define NIST's ECDSA curve parameters left room for suspicion about how they had been chosen. An Anthropic employee asked an internal research model to investigate without pointing it to the rumored passphrase. In under half an hour, Claude found that the seeds for P-192, P-224, P-256, P-384 and P-521 came from the C library's lrand48 generator initialized with a Unix timestamp—not from a hash of a secret phrase. For P-256, the published seed was candidate 1,842 in the generator's run. The Reddit post's screenshot captures Claude checking the result: “Is it suspicious that such an obvious thing wasn't discovered in 25 years?”
The search tested 34 combinations of 1990s-era generators and output slices. Four binary-curve seeds shared a pattern of zero top bits across 20 words, estimated at a 1-in-5,810 chance under random output. That pattern pointed to lrand48, which returns only the top 31 bits of a 48-bit state. The prime-curve seeds exposed truncated generator output, so Claude used lattice reduction to recover the state. Anthropic says the five prime-curve seeds and five ANSI X9.62 example-curve seeds all matched the same lrand48 output pattern.
The investigation also traced six base points generated in May 1997, including P-192 and five ANSI example curves, to a simple procedure: initialize a generator with a small integer, discard seven outputs, then try candidate x-coordinates from 26-bit outputs reduced modulo p until one lies on the curve. Anthropic lists the recovered generator seeds as 20000 for P-192; 20420, 20507 and 20509 for prime239v1–v3; and 20512 and 20517 for prime192v2 and v3.
Several questions remain open. The B-163 binary seed is still unexplained, as are the base points for P-224, P-256, P-384 and P-521 and the NIST binary curves. Anthropic also notes that some viable candidate seeds appear to have been skipped: candidate 876 in the P-256 run, three for P-224, and seven across the ANSI runs. The company says the small number does not make deliberate weakening plausible, though it cannot explain the selection criteria.
Anthropic emphasizes that this is not a cryptographic break, a new attack or a weakness in ECDSA; the reproducible timestamp-based seeds make deliberate backdoors less plausible. The $36,864 seed-finding bounty will be donated to the Internet Security Research Group.
