25 Years of Cryptographic Mystery Solved: Claude Traces NIST ECDSA Seeds to Unix Timestamps

2 days ago

10 min read

For more than two decades, one of modern cryptography’s most persistent historical mysteries surrounded a deceptively simple question: where did the seemingly unexplained seed values behind several standardized NIST elliptic curves actually come from?

The mystery mattered because cryptographic parameters are foundational. If the process used to generate them is opaque, researchers naturally have to consider whether hidden choices, intentional weaknesses, or undisclosed selection criteria could have influenced the resulting curves.

In October 2026, Anthropic researchers reported that Claude had reconstructed the origin of the seeds used for multiple NIST and ANSI X9.62 elliptic curves. The breakthrough did not reveal a vulnerability in ECDSA, nor did it invalidate the curves. Instead, it provided a reproducible explanation for parameters that had remained unexplained since the 1990s.

The finding is also significant for another reason. Claude did not discover the answer by following the most famous historical clue. It approached the problem as a software reconstruction exercise, inferred the likely behavior of old pseudorandom number generators, searched for their statistical fingerprints, recovered internal states, and then worked backward to the timestamps that initialized them.

That combination of cryptographic reasoning, historical reconstruction, pattern recognition, and automated computation offers a revealing example of how AI can contribute to difficult technical investigations.

Why the Origins of the NIST Curves Became a Cryptographic Mystery

Elliptic-curve cryptography uses mathematical structures that make certain operations easy in one direction but computationally difficult to reverse. ECDSA, the Elliptic Curve Digital Signature Algorithm, uses these properties to create digital signatures for authentication and integrity.

NIST standardized a collection of elliptic curves as part of the Federal Information Processing Standard FIPS 186-2 in 2000. The standardized parameters included curves over both prime and binary fields.

For the curves, the published specifications included seed values whose hashes were used in determining the coefficient that defines part of the curve equation. The seeds themselves were supplied to NIST by the NSA, but the historical documentation did not explain how those values had been generated.

That omission created an uncomfortable gap in the provenance of the parameters.

Cryptographers could inspect the resulting curves and evaluate their mathematical properties, but they could not independently reconstruct the original process that produced every seed. In cryptographic engineering, unexplained randomness can become a source of suspicion because a parameter-selection process can theoretically be manipulated if someone knows what property they want to engineer into the final result.

The issue became sufficiently prominent to inspire investigations, historical speculation, and eventually a bounty for recovering the origin of the seeds.

One widely circulated account attributed the values to a humorous phrase that had supposedly been hashed. That explanation, associated with a recollection from the late NSA employee Jerry Solinas, ultimately proved incorrect.

Claude's discovery points to something considerably more mundane.

Claude Found a 1990s Random Number Generator Behind the Seeds

Anthropic's investigation concluded that the unexplained seeds were generated using lrand48, a pseudorandom number generator historically available in C environments.

The crucial discovery was that the generator had apparently been initialized using Unix timestamps.

Instead of a sophisticated cryptographic construction, the process involved a conventional linear congruential generator with a 48-bit internal state. The generator produced candidate bytes that could then be tested for suitability as elliptic-curve seeds.

This distinction is important.

A PRNG such as lrand48 is not designed to provide cryptographic randomness. Its output is deterministic once its internal state is known. If an attacker can determine the state or sufficiently narrow the seed, future and previous outputs can be reconstructed.

That weakness, however, does not automatically translate into a weakness in the elliptic curves generated from historical outputs. The important question is what role the PRNG played during parameter generation and whether the resulting parameters possess an exploitable mathematical weakness.

The investigation found evidence that the historical process was much simpler than many theories had assumed.

The seed-generation process

The reconstructed process can be understood conceptually as follows:

Initialize the pseudorandom generator using a Unix timestamp.
Generate successive pseudorandom outputs.
Combine selected output bits into candidate seed values.
Test candidates against the requirements for the intended curve.
Continue until a suitable candidate is selected.
Publish the resulting seed as part of the curve parameters.

For the prime-field curves, the reconstruction identified a pattern corresponding to lrand48() >> 23, producing 20 bytes for each candidate.

The published code provided by Anthropic reproduces the process using the lrand48 recurrence and the recovered timestamps.

For example, the reconstructed process reproduces the published P-256 seed:

C49D360886E704936A6678E1139D26B7819F7E90

The significance is not simply that the output looks similar. The recovered process regenerates the exact published values.

The Statistical Fingerprint That Pointed to lrand48

The discovery began with a technical clue embedded directly in the seed values.

Claude examined the published seeds and considered how an old software implementation might have produced them. Rather than assuming a cryptographic hash, it explored the possibility that the original developers had used a standard pseudorandom generator available in the computing environments of the period.

The lrand48 generator has a distinctive property: it exposes only the upper 31 bits of its 48-bit internal state.

That leaves a recognizable pattern in its output.

Claude built a scanner that examined the published seeds bit by bit and tested combinations of historical generators and output formats. The analysis considered 34 combinations of generator types and output slices.

Some seeds displayed an unusual concentration of zero-valued top bits. Four of the ten relevant seeds showed the top bit cleared across all 20 words. According to the supplied research, the probability of that occurring by chance under the relevant model was approximately 1 in 5,810.

Once the pattern was recognized, the generator became identifiable.

This is a powerful example of a general cryptanalytic technique: seemingly meaningless data can contain implementation fingerprints. A pseudorandom sequence may appear random to a human reader while still carrying structural evidence about the algorithm that produced it.

Recovering the Hidden PRNG State

Identifying lrand48 was only the first step.

The generator has a 48-bit internal state, while its output exposes fewer bits. Claude therefore had to reconstruct the missing information.

For several seeds, the process was comparatively direct. The first observed word could be combined with all possible values for its hidden 17 bits, after which the following outputs could be tested to determine which candidate state was consistent.

For the prime-field curves, the situation was more difficult because the published seeds preserved a truncated portion of each generator output.

This became a mathematical state-recovery problem involving a linear congruential generator.

The investigation used lattice techniques, including the Lenstra–Lenstra–Lovász, or LLL, basis reduction algorithm. LLL is a well-established mathematical tool for finding unusually short vectors in lattices and has applications in cryptanalysis and computational number theory.

Claude tested possible bit windows because the researchers did not initially know exactly which part of the internal state had been retained in the historical construction.

The result was striking: five NIST prime-field seeds and five additional ANSI X9.62 seeds exhibited the same lrand48() >> 23 construction.

Recovering the state allowed the researchers to reproduce the complete 160-bit seeds. The probability that unrelated random values would independently produce this exact structure is effectively negligible for the purpose of establishing the reconstruction.

The Timestamps Completed the Historical Picture

Once the internal states were recovered, the researchers could run the generator backward.

The lrand48 recurrence is reversible when the relevant state information is known. The researchers therefore stepped backward until reaching a state consistent with initialization through srand48.

That made it possible to identify the original initialization values.

For the ten prime-curve seeds, the recovered initialization values corresponded to Unix timestamps between May 1997 and April 1998.

The reconstructed dates include:

Curve	Recovered date	Candidate
P-192	May 18, 1997	139
P-256	August 16, 1997	1,842
P-384	August 30, 1997	2,688
P-224	April 3, 1998	7,026
P-521	August 8, 1997	1,136
prime239v1	May 15, 1997	2,185
prime239v2	May 15, 1997	2,320
prime239v3	May 15, 1997	3,048

The binary curves revealed a related pattern. Their recovered initializations pointed toward February 1984 when interpreted through the relevant state construction, while doubling the timestamps produced dates in April 1998. The supplied research notes that the original program may have divided the clock value by two.

That interpretation remains part of the reconstruction rather than a fully documented historical record of the original software.

Claude Also Traced Several Elliptic-Curve Base Points

The investigation did not stop at the seeds.

Every elliptic curve also requires a base point, commonly represented as G, from which public keys are mathematically derived.

The seed used to define curve parameters does not itself determine the base point. That meant another historical question remained: how were the published base points selected?

Claude found a reproducible explanation for six curves generated in May 1997, including P-192 and several ANSI X9.62 example curves.

The base points were traced to the random-number generation mechanism used in FreeLIP, an arbitrary-precision integer arithmetic package associated with Arjen Lenstra. Early versions of Victor Shoup's NTL library contained the same code.

The reconstructed procedure involved:

Initializing the generator with a small integer.
Discarding seven outputs.
Producing candidate x-coordinates from 26-bit outputs.
Reducing candidates modulo the field prime.
Testing whether the resulting coordinate belonged to the curve.
Continuing until a valid point was obtained.

The recovered seeds included 20,000 for P-192 and several values in the 20,000 range for the ANSI example curves.

The supplied reproduction code generated x-coordinates that matched the published base points for all six tested curves.

That is a second layer of provenance that had previously remained unexplained.

What the Discovery Does Not Mean

The most important conclusion is also the easiest to misunderstand.

This is not a cryptographic break.

The discovery does not demonstrate that ECDSA is insecure. It does not provide a practical attack against the standardized NIST curves, and it does not establish that the curves contain deliberate weaknesses.

In fact, understanding how the seeds were generated reduces one of the major historical uncertainties surrounding their provenance.

The previous mystery allowed a broad range of speculation because the selection mechanism was undocumented. A reproducible explanation based on ordinary pseudorandom generation and timestamps provides considerably less room for theories involving carefully engineered hidden properties.

That does not prove every historical decision made during curve selection was innocent or fully documented. It does, however, substantially change the evidentiary picture.

Cryptographic assurance is strengthened when independent researchers can reproduce parameter generation rather than merely trusting an unexplained origin story.

The Remaining Mysteries Matter

The investigation has not solved every question.

Some candidate seeds that could apparently have produced viable curves were skipped. For P-256, for example, candidate 1,842 became the published seed, while candidate 876 also reportedly produced a prime-order curve with parameters selected through the same general process.

P-224 and other ANSI X9.62 runs also contained skipped candidates.

Why were those candidates rejected?

Several explanations are possible, including undocumented selection criteria or an artifact of the original generation procedure. The available evidence does not establish that a particular security property was deliberately targeted.

There are also unresolved parameters.

One binary-field seed, B-163, remains unexplained by the reconstruction described by Anthropic. The origins of the base points for P-224, P-256, P-384, and P-521 also remain unknown, as do the corresponding base-point generation procedures for the NIST binary curves.

The discovery therefore closes a major chapter without ending every historical question.

Why This Matters for AI-Assisted Cryptography

The deeper significance of the episode extends beyond one collection of elliptic curves.

Claude's success demonstrates a workflow that could become increasingly important in cybersecurity research:

Observe → hypothesize → test historical implementations → recover hidden state → reproduce → validate.

The system was not simply asked to retrieve a known fact. It had to reason from observable artifacts, construct a plausible model of legacy software, test alternative explanations, recognize statistical structure, and use mathematical techniques to validate the hypothesis.

Cryptography is particularly well suited to this kind of investigation because algorithms and parameters leave mathematical fingerprints.

Older software often provides additional clues. Weak PRNGs, implementation quirks, timestamp-based initialization, repeated constants, and output truncation can all reveal information about how historical systems were constructed.

AI systems capable of combining source-code reasoning with mathematical analysis may therefore become useful tools for digital archaeology, cryptographic auditing, reverse engineering, and security research.

The important lesson is not that AI has replaced cryptographers. Rather, AI can dramatically accelerate the search through large spaces of plausible explanations, allowing human researchers to concentrate on verification, interpretation, and historical context.

A New Model for Investigating Cryptographic Provenance

The NIST curve mystery also illustrates why reproducibility is so valuable in security engineering.

A cryptographic standard is more trustworthy when researchers can independently reconstruct its parameter-selection process. Transparency allows the community to distinguish between:

A parameter that merely appears random.
A parameter generated through a documented deterministic process.
A parameter whose generation can be independently reproduced.
A parameter whose selection criteria remain unexplained.

Those distinctions matter because security depends not only on mathematical hardness but also on confidence in implementation and parameter generation.

The newly reconstructed process does not make historical documentation unnecessary. Instead, it demonstrates why documenting parameter generation should be treated as part of cryptographic engineering rather than an optional historical detail.

Modern cryptographic standards increasingly emphasize transparent generation procedures for precisely this reason.

From Cryptographic Suspicion to Reproducible History

The 25-year mystery surrounding the origins of several NIST elliptic-curve seeds has produced an unusual ending.

What appeared for years to be a potentially sophisticated cryptographic secret was traced to a much simpler mechanism: a 1990s-era pseudorandom number generator initialized using Unix timestamps, followed by candidate generation and selection.

Claude's investigation reconstructed the process for multiple NIST and ANSI X9.62 seeds, recovered historical initialization times, reproduced the published values, and also identified the generation mechanism behind several base points.

The result does not weaken ECDSA. Instead, it removes a significant layer of uncertainty surrounding the provenance of parameters that have been scrutinized for decades.

There are still unanswered questions, particularly concerning skipped candidates, B-163, and several base points. Those unresolved details are useful reminders that reproducibility is a process, not a single discovery.

For the broader AI industry, the episode demonstrates another emerging capability: advanced models can participate in sophisticated technical investigations where the answer is not explicitly present in any document. They can formulate hypotheses, inspect patterns, reason about legacy systems, and generate executable tests that turn historical speculation into reproducible evidence.

As Dr. Shahid Masood and the expert team at 1950.ai continue examining the intersection of artificial intelligence, cybersecurity, and emerging technology, this discovery offers a compelling example of where AI-assisted research may be heading. The most valuable systems will not merely retrieve information. They will help researchers reconstruct how complex systems were built, test competing explanations, and make difficult technical questions independently verifiable.