Anthropic reported on Oct. 16, 2026, that Claude traced the seeds for five NIST prime curves to output from the lrand48 pseudorandom-number generator, initialized with Unix timestamps. The finding concerns the origins of selected curve parameters used with ECDSA, not a new attack on the signature algorithm. Anthropic’s account describes the reconstruction and its limits.
Five NIST curve seeds traced to timestamp-initialized output
Anthropic says the method produced 20-byte candidate seeds from lrand48() output, using the pattern lrand48() >> 23. Its report names P-192, P-224, P-256, P-384 and P-521; the timestamps in its reproduction code range from May 1997 through April 1998. Anthropic also reports the same output pattern in five example prime-curve seeds from ANSI X9.62.
The NIST curves appeared in the Digital Signature Standard that NIST adopted in 2000, according to Anthropic. The reported reconstruction addresses how particular parameters were generated, not every curve that can be used in cryptography.
ECDSA is an algorithm, not a curve family
ECDSA is a digital-signature algorithm. NIST P-curves are mathematical parameters that can be used with it; they are not ECDSA itself. The NIST standard describes elliptic-curve choices, and cryptography commenter bascule likewise noted that ECDSA can use curves outside the NIST P-curve family. (NIST SP 800-186; bascule’s clarification).
That distinction keeps Anthropic’s result in scope: it concerns selected NIST curve parameters, not every system that uses ECDSA.
P-256 candidate 876 was viable, but the selection reason is unknown
Anthropic’s reproduction identifies the published P-256 seed as candidate 1,842. It also reports that candidate 876 produced a viable prime-order curve of the relevant size using the same parameter-generation method. Anthropic says it does not know why candidate 876 was passed over.
Six base-point origins and other unresolved cases
Anthropic reports a separate reconstruction for six base points: P-192 and five ANSI X9.62 example curves. Its described method uses FreeLIP, discards seven generator outputs, then forms candidate x-coordinates from 26-bit outputs reduced modulo p, repeating until a candidate lies on the curve.
Anthropic says the seed origin for B-163 remains unexplained. It also says the base points for P-224, P-256, P-384, P-521 and the NIST binary curves remain unexplained.
Anthropic’s stated security assessment
Anthropic says the findings are not a cryptographic break, a new attack or a weakness in the curves, and that users do not need to take action. The company’s assessment concerns this reported provenance finding.
