Anthropic Says AI Model Traced NIST Cryptographic Seeds to 1990s Random Number Generator

Claude reconstructs how NIST curve seeds were generated

Anthropic said on October 16 that its internal Claude research model traced how the public seeds for five NIST elliptic curves were produced, linking them to a 1990s C-library random-number generator initialized with Unix timestamps from 1997 and 1998.

The company published reproduction code alongside its research post. It emphasized the finding is not a cryptographic break, does not reveal a way to steal private keys, and does not enable signature forgery.

"This is not a cryptographic break, new attack, or weakness in the ECDSA curves," Anthropic wrote. "There is no action to be taken or things to do differently."

Why the seeds matter for crypto users

The seeds in question are public inputs used to derive curve parameters, not the secret wallet seeds that protect cryptocurrency funds. NIST published them in its 2000 Digital Signature Standard so anyone could verify how the curve coefficients were derived.

The seeds themselves came from the NSA without an explanation of their origin, which had left room for suspicion that the curves might have been deliberately chosen to contain hidden weaknesses.

What Claude found

Anthropic says the model identified the origins of the P-192, P-224, P-256, P-384 and P-521 seeds in under thirty minutes. Rather than being hashes of humorous phrases, as some had long hypothesized, the seeds were outputs of lrand48, a pseudorandom-number generator found in 1990s C libraries.

The process initializes the generator with a Unix timestamp and draws successive 20-byte candidate seeds. P-256's standardized seed lands at candidate 1,842 in that sequence. Claude recovered generator states from truncated outputs using lattice-reduction techniques and worked backward to identify the initializations.

Four NIST binary-curve seeds — B-233, B-283, B-409 and B-571 — also fit the generator. Their clock interpretation is less certain: doubling the recovered initialization values gives a timestamp of April 17, 1998, suggesting the original program may have halved the clock value before seeding.

Separate reproduction code also recreates the base-point x-coordinates for P-192 and five ANSI X9.62 example curves using the FreeLIP arithmetic package's generator. A base point is the fixed starting value multiplied by a private key to produce a public key, and its selection is separate from the curve seed.

Gaps and unanswered questions

• The seed for the B-163 binary curve remains unexplained.


• The origins of the base points for P-224, P-256, P-384, P-521 and the NIST binary curves are not accounted for.


• Some viable candidates were skipped during generation. P-256's run passed over candidate 876, which also produces a prime-order curve of the required size, but Anthropic does not know why it was skipped.


• It is unknown how many timestamp-seeded runs were attempted in total.

Does this change anything for blockchain security?

P-256, also known as secp256r1, supports hardware-backed and passkey signing. Ethereum's specification for P-256 verification identifies Apple Secure Enclave, Android Keystore and FIDO2/WebAuthn devices as relevant signing systems. It is a different curve from secp256k1, which is used by Bitcoin and Ethereum for transaction signing.

Anthropic argues that the small number of skipped candidates makes deliberate weakening implausible, though it acknowledged that searching across timestamps for a particular property remains technically conceivable.

What happens next

Anthropic published the reproduction code and research findings publicly. No changes to NIST standards or curve usage were announced, and the company said no action is required.

Sources

• The Defiant

Read also: 84 Million XRP Moved to Exchange Wallets as Price Approaches $1.30

Read also: Deutsche Bank to launch crypto custody for institutions within weeks

Read also: Filecoin plans to shift block rewards toward paid storage