Anthropic Says Claude Traced Five NIST Curve Seeds

On October 16, 2026, Anthropic published a report saying an internal Claude research model traced the origins of five NIST elliptic-curve seeds to timestamp-initialized lrand48 output. Anthropic said the model reached the result in under half an hour. The finding concerns how specific curve parameters were generated, and Anthropic says it is not a new attack or weakness in ECDSA. Anthropic’s report gives a reconstructed timestamp and candidate position for each curve.

What Anthropic says Claude reconstructed

The five curves are P-192, P-224, P-256, P-384, and P-521. Anthropic describes a process that starts a pseudorandom-number generator with a Unix timestamp, produces successive 20-byte candidate seeds, then tests them against the curve-generation rules in ANSI X9.62. Its account says the seed matches follow lrand48() >> 23.

Anthropic also reports matching five additional ANSI X9.62 prime-curve seeds to the same output pattern. For the ten seeds, it says each recovered generator state reproduces all 160 seed bits.

The five reported timestamps and candidate positions

Anthropic’s published code lists these reconstructed initialization times and candidate indexes for the NIST curves:

Cryptographer Filippo Valsorda separately reported reproducing the seed-generation process in Go. He said the Anthropic team claimed his $36,864 bounty on October 15, 2026, and donated it to the Internet Security Research Group (ISRG).

What the finding says about ECDSA security

ECDSA is a digital-signature algorithm; the finding concerns the origins of particular NIST curve parameters used with it. Anthropic says the reconstruction is not a cryptographic break, a new attack, or an ECDSA weakness. It also says the result makes an intentional-backdoor theory less plausible.

That is Anthropic’s security assessment of the seed reconstruction, not a claim that the work uncovered a way to compromise signatures. The reported result is about the provenance of the five named curves.

What the skipped candidates leave open

The reconstruction does not explain every candidate-selection decision. Anthropic identifies P-256 candidate 876 as another candidate that produced a prime-order curve of the right size; the published seed is candidate 1,842.

Valsorda reports one rejection rule: candidates were rejected when the bit length of the curve order, n, exceeded the bit length of the field, p. He says this still leaves roughly twice as many valid seeds as were published, and that another selection criterion remains unknown. Valsorda’s account describes his reproduction and the candidate-selection rule.