The NSA's Mystery Curve Seeds Were a 1997 Timestamp. Here's Why That's Good News
The five NIST prime curves were hashed from seeds nobody could explain for a quarter of a century. Anthropic says they came from a stock C random number generator and the system clock, and that this makes a backdoor much less plausible, not more.
No passphrase, no "Give Bob and Jerry a raise," no hash at all. According to Anthropic's write-up of October 16, 2026, the seeds behind P-192, P-224, P-256, P-384 and P-521 were the direct output of lrand48, the 48-bit linear congruential generator in the C standard library, seeded with Unix timestamps between May 1997 and April 1998 [1]. Steve Weis, one of the ten authors, broke the news on X the same day [10].
The backstory is well known by now. The NSA's Jerry Solinas handed the seeds to the ANSI X9.62 committee in fall 1997, according to Alfred Menezes [4]; NIST published the curves in FIPS 186-2 in 2000 [7]; Koblitz and Menezes dissected the suspicion in 2015 [5]; and Valsorda's bounty, open since October 2023, offered $12,288, tripled if donated [3]. Solinas, who died in 2023, had recalled hashing a humorous phrase he could no longer remember [4].
Two things worth saying up front. Anthropic calls it "not a cryptographic break, new attack, or weakness" [1]. And Bitcoin does not use any of these curves: it signs with secp256k1, whose coefficients are 0 and 7 [6].
The recipe, in one paragraph
We ran it. Anthropic's script reproduces C49D3608 86E70493 6A6678E1 139D26B7 819F7E90 and the other four NIST prime-curve seeds. We then fed the regenerated P-256 seed through the X9.62 SHA-1 derivation and got the b coefficient published in SEC 2 [6]. The clock-seeded generator yields the real curve, not just a matching string.
How the model got there is the interesting part. In four seeds, the top bit of every 32-bit word was zero, a 1-in-5,810 event by chance and the signature of lrand48, which returns only 31 of its 48 state bits [1]. The prime-curve seeds kept just one byte per output, so the state had to be recovered as a truncated-LCG lattice problem with LLL, then stepped backwards to an srand48 starting point [1]. According to Anthropic, an internal research model did this in under half an hour, without being given the passphrase lead that several employees had chased in vain [1].
Why fewer degrees of freedom is the whole story
The worry about "verifiably random" curves was never SHA-1 itself. It was that whoever controlled the seed could re-roll until a curve with a private weakness came up. In 2017 Daniel Bernstein and Tanja Lange described a technique that could exploit about 70 bits of freedom in seed selection to target a hypothetical class of weak prime-order curves [2].
Valsorda's estimate after this week: even allowing any timestamp in 1997-98 and any of the first 16 valid candidates, the NSA would have had "barely 30 bits of freedom," which he says completely rules out the Bernstein-Lange approach and any NOBUS backdoor [2]. Anthropic's own conclusion is "much less room for subversion" [1].
Roughly 30 bits of freedom at most, per Valsorda: not enough to steer the NIST curves toward a small class of weak ones [2]
What Anthropic leaves open
- Skipped candidates. For P-256, candidate 876 of the same run also gives a prime-order curve of the right size, yet 1,842 was published. P-224's run passed over three such curves and the ANSI X9.62 example runs seven more [1]. Valsorda identified one undocumented rejection rule (the order n may not be longer in bits than the field p) but not the other [2].
- B-163. The fifth binary-curve seed fits nothing tried so far [1].
- Base points. Claude traced the base points of six May 1997 curves, including P-192, to the FreeLIP random number generator, but those of P-224, P-256, P-384 and P-521 remain unexplained [1].
- Number of runs. Anthropic concedes that searching over timestamps for a specific property is conceivable in principle, though it would only make sense if you planned to disclose the timestamp as proof of innocence, and "nothing in the numbers shows how many runs there were" [1].
secp256k1: no seed, one loose end
secp256k1 belongs to what SEC 2 calls Koblitz curves, chosen by searching for parameters with an efficiently computable endomorphism until a prime-order curve turned up, rather than from a hashed seed [6]. Its coefficients are a = 0 and b = 7 [6]. Bitcoin uses it for ECDSA and, since Taproot, for BIP-340 Schnorr signatures [8].
Satoshi never explained the choice. The common reading, that he deliberately avoided NIST's opaque seeds, is plausible but remains an interpretation.
secp256k1 is not entirely free of mysteries either. Nobody knows how its generator G was picked. "We don't know," Pieter Wuille wrote, pointing to an oddity: half of G has an x-coordinate only 166 bits long [9]. We reproduced that figure ourselves. Wuille adds that the choice of generator is believed to be irrelevant to the security of single-generator schemes such as ECDSA and BIP-340 [9]. It is the same kind of loose end Anthropic leaves for the P-256 base point.
The threat that is actually on the table
This lands days after Justin Drake urged a "bunker mode" in case AI breaks ECDSA. What Anthropic published is the opposite kind of result: a model reconstructing 1997 tooling, not finding a shortcut against signatures. Valsorda's closing line is the real forward-looking point: the NIST curves finished their rehabilitation "just in time for them to be retired in favor of post-quantum signatures" [2]. Bitcoin faces the same migration question with secp256k1, which we cover in BIP-360 and the quantum threat.
The $36,864 bounty goes to ISRG, the non-profit behind Let's Encrypt [1][2][11].
Block height, network status and consensus changes as they happen are on our Network page.
Sources
Source type in parentheses.
- Anthropic, Claude reveals ECDSA curve origins, October 16, 2026. lrand48 origin and 1997-98 timestamps, recovery method, FreeLIP base points, open questions, reproducible code, ISRG donation. (Primary, authors of the finding)
- Filippo Valsorda, The NIST Elliptic Curves Seeds Bounty Has Been Claimed, October 16, 2026. Independent verification, rejection criteria, roughly 30 bits of freedom, Bernstein-Lange technique ruled out. (Primary, bounty organizer)
- Filippo Valsorda, Announcing the $12k NIST Elliptic Curves Seeds Bounty, October 5, 2023. Bounty terms and the five target seeds. (Primary, bounty organizer)
- Steve Weis, How were the NIST ECDSA curve parameters generated?, September 2023, updated 2024 and 2026. Menezes's account and Solinas's emails. (Primary, research with first-hand accounts)
- Neal Koblitz and Alfred Menezes, A Riddle Wrapped in an Enigma, IACR Cryptology ePrint Archive 2015/1018. (Primary, academic paper)
- Certicom Research, SEC 2: Recommended Elliptic Curve Domain Parameters, version 2.0, January 27, 2010. secp256k1 and secp256r1 (P-256) parameters, P-256 seed, how each family was chosen. (Primary, standard)
- NIST, FIPS 186-2, Digital Signature Standard, January 27, 2000, Change Notice 1 of October 5, 2001. (Primary, official standard)
- Pieter Wuille, Jonas Nick and Tim Ruffing, BIP-340: Schnorr Signatures for secp256k1. (Primary, specification)
- Pieter Wuille, answer on how secp256k1's generator was chosen, Bitcoin Stack Exchange, 2022. (Secondary, technical forum)
- Steve Weis, post on X, October 16, 2026. (Primary, social media)
- Internet Security Research Group, official site. (Primary, official site)
More in Network and mining
Last updated: October 17, 2026