Why curve provenance matters
Elliptic-curve cryptography is only as trustworthy as the numbers it is built on. The NIST curves that anchor most of the internet’s secure connections — P-192, P-224, P-256, P-384 and P-521 — derive their shape from a short “seed” value, and for twenty-five years no one outside the NSA could explain where those seeds came from. Strong cryptographic parameters are meant to be “nothing-up-my-sleeve” numbers, produced by a process transparent enough that no one can hide a weakness in them. The NIST seeds never met that standard, and the silence invited a specific worry: that an agency had quietly selected curves it knew how to break.
That worry now looks misplaced. In work published October 16, 2026, Anthropic described how its Claude model traced each of the five seeds back to an ordinary random number generator from a 1990s C library, seeded from a system clock. The company is explicit that the work is “not a cryptographic break, new attack, or weakness in the ECDSA curves.” In practice the result points the other way, toward parameters that can finally be reproduced and checked.
What the investigation found
For years the leading theory held that NSA cryptographer Jerry Solinas had produced the seeds by hashing a humorous passphrase, something along the lines of “Give Bob and Jerry a raise.” Solinas died in 2023 without settling the matter, and the passphrase story turned out to be wrong. The seeds were not hashes at all.
According to Anthropic, an employee asked an internal research model in October 2026 to work out how the seeds had been generated. In under half an hour Claude identified them as outputs of lrand48, a linear congruential generator that shipped with 1990s-era C libraries. The giveaway was structural: lrand48 returns only the top 31 bits of its 48-bit internal state, and the seeds showed exactly that zeroing pattern. Claude wrote a scanner that slid along each published seed bit by bit, checking whether adjacent chunks matched consecutive outputs from 34 candidate generators. Recovering the state of the prime-curve seeds needed a lattice step — the LLL algorithm — because those seeds preserved fewer bits per output. Every recovered 48-bit state regenerated all 160 bits of its seed, which Anthropic notes does not happen by chance. The initial states resolved to Unix timestamps between May 1997 and April 1998.
Claude also traced the base points of P-192 and five ANSI X9.62 example curves to a different generator: the one inside FreeLIP, Arjen Lenstra’s long-integer package, seeded with small integers such as 20000 and 20517.
What changes, and what does not
The practical takeaway for the ecosystem is confidence. Because the seeds can now be reproduced from a clock-seeded generator, there is far less room for a deliberate subversion to hide in them. The finding does not directly change Bitcoin or Ethereum: those networks sign transactions with secp256k1, a curve specified by the Standards for Efficient Cryptography Group rather than NIST. But the NIST curves still protect the TLS connections and web infrastructure that exchanges and wallets depend on, so cleaner provenance is a genuine win.
Two loose ends remain. Anthropic notes that the generator appears to have skipped some viable candidate seeds — for P-256, the published seed was candidate 1,842 even though candidate 876 also produced a valid curve — and the company does not know what selection criteria, if any, were applied. The base points of the four largest curves, P-224 through P-521, do not fit the FreeLIP recipe, and their origin is still unexplained. The disclosure also landed next to a separate Anthropic result in which Claude redesigned quantum circuits, cutting roughly 17-fold the gate count for elliptic-curve point addition — a reminder that provenance is one question, and quantum resistance is another.
Source: BlockchainReporter.