Claude found the answer in under 30 minutes. Researchers had looked for 25 years1.
The question was small and strange: who picked the seed numbers behind the world's most common signature standard, and why? Anthropic published Claude's answer on Oct. 161. A researcher who had put up money for that same answer checked it the same day, by hand2.
Thirty Minutes, Twenty-Nine Years
NIST adopted the standard called ECDSA in 2000, inside a document called FIPS 186-21. It listed curves of different sizes, each one built from a seed. The NSA supplied every seed, and left their origin a mystery1.
That silence bred three decades of suspicion. A curve's seed can hide a weakness, if whoever picks it tries enough seeds first. For years, the best guess was that an NSA employee named Jerry Solinas had hashed a joke. "The message was along the lines of 'Give Bob and Jerry a raise' or 'Bob and Jerry rule' or something like that," Solinas said in 2015, before his death in 20231.
The passphrase guess collapsed. In October 2026, a curious Anthropic employee asked an internal Claude research model how the seeds were made. The employee kept the joke theory out of the question1.
Claude guessed the seeds came from an old random-number function built into 1990s C libraries, a different source than any hash. It scanned the published bytes bit by bit and matched a telltale pattern. Then it reversed a 1997-era program's math to recover the exact clock reading that had started it1.
Ten seeds, all from one family of curves, trace back to timestamps between May 1997 and April 19981.
The Bounty That Sat for Three Years
Filippo Valsorda had been waiting three years for this. In 2023, the researcher offered a bounty for anyone who could explain the seeds. He set it at $12,288, tripled to $36,864 if the winner gave it away2.
The bounty sat unclaimed until Anthropic's team collected it, on Oct. 152. They gave the full amount to the Internet Security Research Group, the nonprofit behind the free encryption service Let's Encrypt1. Valsorda checked the write-up himself, instead of taking Anthropic's word for it. He rebuilt Claude's math in the programming language Go and matched every published seed2.
"We now know how the seeds of the NIST elliptic curves were generated: they're not the hash of some saucy sentence, but the output of drand48 seeded with the time, which was indeed in 1997-98," Valsorda wrote2.
Thirty Bits Short of Seventy
Here is why researchers care. In 2017, researchers named Daniel Bernstein and Tanja Lange described a theoretical attack on NIST's curves to the paper's original authors2. Their idea needed about 70 bits of freedom in picking a seed to aim at a hidden class of weak curves.
The NSA's 30 bits of freedom fall short of the 70 bits a weak-curve attack would need
Bits of freedom in choosing a curve seed, by Filippo Valsorda's count, generous assumptions included
Each column is a count of bits: the magenta column is the freedom Valsorda calculates the NSA actually had, the gray column is the freedom Bernstein and Lange's 2017 theory said an attacker would need.
Valsorda's 30-bit count already assumes the NSA could pick any timestamp across 1997 and 1998 and any of the first sixteen candidates each run produced, a generous reading in the NSA's favor.
Source: words.filippo.io [2]. Chart by The AILately.com Desk.
The numbers behind this chart
| Item | Value |
|---|---|
| Needed for attack | 70 bits |
| NSA actually had | 30 bits |
Claude's accounting leaves far less room than that. Even granting the NSA every timestamp across 1997 and 1998, and the first sixteen candidates each run produced, the total stays small. Valsorda counted barely 30 bits of freedom2. That margin falls short of steering toward a weak curve on purpose.
Valsorda measured it as too small, he wrote, to embed "any kind of NOBUS backdoor"2.
Anthropic phrases its own conclusion more carefully. The company calls a backdoor "much less plausible," a weaker claim than ruling it out1. Valsorda goes further. He calls this week's finding part of the NIST curves' "rehabilitation arc," strong enough that he would "now personally recommend" them over rival designs2.
A seed generated in 1997 stayed unexplained for 29 years, until Claude traced it in 2026
Key dates in the NIST curve-seed mystery, 1997 to 2026
Each point is a dated event in the mystery's history, from the seeds themselves to Anthropic's team claiming the bounty.
Sources: Anthropic [1]; words.filippo.io [2]. Chart by The AILately.com Desk.
The numbers behind this chart
| Date | Event |
|---|---|
| 1997 | Seeds generated. The NSA generates the P-256 seed and others, by clock-seeded random numbers |
| 2000 | NIST adopts ECDSA. FIPS 186-2 publishes the curves and leaves their seeds unexplained |
| 2017 | Bernstein and Lange's theory. A technique needing 70 bits of freedom reaches the paper's authors |
| 2023 | Valsorda's bounty. A $12,288 bounty opens for anyone who can explain the seeds |
| Oct. 15, 2026 | Claude traces the seeds. Anthropic's team claims the bounty and gives it to ISRG |
Who Actually Solved It
Several things remain genuinely open. Anthropic admits one seed, called B-163, "fits nothing Claude has tried"1. The origin of four curves' base points, the fixed starting coordinates every public key multiplies from, stays a mystery1. A handful of candidate seeds got passed over, for reasons the record keeps quiet1.
Gabriel Anhaia, a software engineer who writes about AI tools, took Anthropic's post point by point. He credits the math. His doubt lands on the framing around it.
"A question that had stood since the late 1990s fell to a guess about old C libraries plus a standard lattice technique, and a human expert confirmed it in code within a day," Anhaia wrote3. His point lands on one word: confirmed. The public evidence for the half-hour claim is Anthropic's own account of an internal run, on a model it declines to name past "an internal research model"13.
Valsorda's post reads the credit differently. He names ten Anthropic researchers as the people who "solved the riddle," crediting the team over the model2.
Anthropic's own post stresses something closer to independence. A curious employee typed a question and left the joke theory out of it. Within half an hour, the model had an answer that had escaped every human for 29 years1.
What to do
Read Anhaia's advice past the headline. The useful lesson sits in his closing section, past the opening one. A weak, clock-seeded random generator from 1997 produced numbers that defeated tracing for decades. Eventually, a search guessed the right generator3.
Check what generates your own secrets. If a password reset link, an API key or a session token comes from a language's ordinary random function, swap it out.
Python's random and JavaScript's Math.random() work for games and tests, with weaker safety than a password needs. Reach for a secure generator instead, such as Python's secrets module or Node's crypto.randomBytes3. A 1997 coder's shortcut took 29 years to surface. Yours might take less.
By the numbers
- Under 30 minutes: how long Claude's internal research model took to trace the NIST seeds to their source1.
- Anthropic's team tripled its own bounty, to $36,864, by giving it to the Internet Security Research Group12.
- 1,842: the position in its timestamp's sequence where the published P-256 seed landed1.
- 876: an earlier candidate from that same run that would also have produced a valid curve, skipped for reasons that stay unresolved2.
- Valsorda counted 30 bits of freedom in choosing a seed, even under generous assumptions about what the NSA could try2.
- Bernstein and Lange's 2017 theory needed about 70 bits of freedom to aim at a weak curve on purpose2.
- 1,037 points and 383 comments: the reach of the Hacker News thread discussing Anthropic's write-up4.
- Wikipedia logged 220 pageviews for the Elliptic Curve Digital Signature Algorithm article on Oct. 15, the day Anthropic's team claimed the bounty5.
What to watch
Watch whether another researcher, past Valsorda, publishes an independent rebuild that checks the same seeds. A second check would settle Anhaia's complaint about an unnamed model and an internal clock. Watch Anthropic's open list, too: the unsolved B-163 seed and the four curves whose base points still elude explanation. Either one falling would say more about Claude's method than the first half hour did.
Sources
- Anthropic, "Claude reveals ECDSA curve origins," Anthropic, Oct. 16, 2026, https://www.anthropic.com/research/ecdsa-curve-origins
- Filippo Valsorda, "The NIST Elliptic Curves Seeds Bounty Has Been Claimed," words.filippo.io, Oct. 16, 2026, https://words.filippo.io/seeds-solved/
- Gabriel Anhaia, "Claude Traced the NIST Curve Seeds to a 1997 Clock and lrand48. Nothing to Rotate on P-256," DEV Community, Oct. 17, 2026, https://dev.to/gabrielanhaia/claude-traced-the-nist-curve-seeds-to-a-1997-clock-and-lrand48-nothing-to-rotate-on-p-256-50d3
- ahlCVA, "Claude reveals ECDSA curve origins," Hacker News, Oct. 17, 2026, https://news.ycombinator.com/item?id=50122800
- Wikimedia Foundation, "Elliptic Curve Digital Signature Algorithm, daily pageviews," Wikimedia Pageviews API, Oct. 15, 2026, https://wikimedia.org/api/rest_v1/metrics/pageviews/per-article/en.wikipedia/all-access/user/Elliptic_Curve_Digital_Signature_Algorithm/daily/20261011/20261015