Claude Traces Five NIST Curve Seeds to 1997 and 1998 Timestamps

Disclosed on October 16, the Claude NIST curve seeds discovery traced five sets of cryptographic starting numbers to legacy computer software fed with timestamps from 1997 and 1998. Anthropic stated that its research model recreated these origins in under half an hour, reviving a decades-old NSA mystery.

This finding relates to the creation of widely used NIST elliptic curves rather than an exploit that unlocks cryptocurrency wallets. While Bitcoin (BTC) relies on a different curve, the discovery has reignited debates regarding Satoshi Nakamoto’s design decisions and the transparency of standards securing digital systems.

The Mystery Began With NSA Numbers in the 1990s

In 1997, mathematician Alfred Menezes received curve seeds from Jerry Solinas, an NSA mathematician. In 2000, NIST adopted a collection of NSA-provided curves—including P-256—without disclosing how the agency generated the starting numbers.

Because the seeds were public, concerns centered on whether the NSA tested various alternatives until finding parameters containing weaknesses exploitable solely by the agency.

These suspicions intensified following Snowden disclosures connecting the NSA to efforts to compromise cryptographic standards. Consequently, NIST removed the Dual EC random-number generator from its recommendations, prompting researchers to demand a reproducible explanation for the curve choices.

Cryptographers Alfred Menezes and Neal Koblitz explored this controversy in their 2015 paper, “A Riddle Wrapped in an Enigma.” By then, questions over parameter selection had evolved into a lasting dispute regarding trust in government-backed cryptography.

Records Requests and a Bounty Failed to Resolve the NSA Curve Seeds

Security researcher Steve Weis spent years seeking answers, including submitting public-records requests in 2018. According to CoinDesk’s reporting, NIST stated it possessed no documentation, while the NSA ceased responding.

One hypothesis suggested Solinas generated the seeds from a humorous phrase he later forgot. Investigators tested numerous word combinations in attempts to replicate the published numbers based on that premise.

By 2023, cryptography engineer Filippo Valsorda and other contributors established a $12,288 bounty for a solution, which later exceeded $36,000 conditioned on the winner donating it to charity. Solinas passed away earlier that year, leaving researchers to work entirely from the numbers and accounts from colleagues.

The challenge was distinct: rather than recovering a user’s private key, researchers were attempting to determine the generation process of an already public standard.

How the Claude NIST Curve Seeds Were Rebuilt With an Old C Generator

Earlier this month, an Anthropic employee tasked an internal research model with investigating the issue. By omitting the prior theory regarding a forgotten phrase, the prompt enabled the model to explore alternative pathways.

Claude mapped the seeds for P-192, P-224, P-256, P-384, and P-521 to lrand48, a random-number generator found in older C software libraries, utilizing Unix timestamps as initial inputs.

For P-256, the model generated a sequence featuring an exact match to the published seed. This timestamp-driven approach provided researchers with a tangible, reproducible explanation, superseding the search for a memorable passphrase.

Anthropic noted that this reconstruction makes a deliberately engineered weakness much less probable, though inquiries remain regarding why specific usable candidates were bypassed and how other curve components were selected.

The distinction between public parameters and private secrets is critical here. Predictable randomness poses severe risks if utilized by a wallet to generate a private key—allowing anyone who deduced the generation time to potentially recreate the key and steal funds. Conversely, these NIST seeds were published openly as part of the curve designs.

Ledger’s Joke Pulled Satoshi Back Into the Argument

Nicolas Bacca, co-founder of Ledger, reacted to the discovery with the remark “Checkmate Satoshi,” which drew a reply from Blockstream CEO Adam Back. Their exchange shifted the technical finding into wider discussions concerning Bitcoin’s architectural choices.

As detailed by U.Today, Back wrote, “That’s the NSA’s fault for not revealing the reproducible steps to generate their NIST published curves.” Bacca responded by noting it remained a solid joke.

Pete Kim, lead for Coinbase wallet, also connected the discourse to Bitcoin and Ethereum’s preference for secp256k1 over P-256. Kim attributed that preference largely to apprehensions regarding potential NSA backdoors and praised Anthropic’s results.

Satoshi never publicly clarified why secp256k1 was selected. Nevertheless, its simpler parameters have long favored cryptographers because they eliminate room for a curve creator to intentionally conceal vulnerabilities.

In contrast, P-256 contains a large coefficient generated from an unexplained seed. While reconstructing that seed’s origins addresses historical skepticism, it does not demonstrate that Claude can break the cryptography of either curve.

The Bitcoin Security Question Now Shifts to Reproduction and Quantum Risk

For users of NIST curves, Anthropic’s primary recommendation is simple: no action is required. Researchers’ immediate next steps involve rerunning the program and auditing the pathway from the legacy generator to the published seeds.

Bitcoin’s distinct vulnerability to quantum computing persists. A sufficiently advanced quantum computer could theoretically derive a private key from an exposed public key, regardless of whether the original curve parameters were generated transparently.

Google announced this week that its Willow chip reduced error rates approximately 40-fold in one of the resource-intensive steps such a machine would demand. Currently, no quantum computer possesses the scale and reliability required to compromise a Bitcoin key, and no definitive timeline exists for when that capability will materialize.

Consequently, the immediate impact for cryptocurrency holders is an update to the historical security discourse rather than an urgent wallet migration. Claude’s reconstruction sheds light on the NSA’s legacy numbers while leaving the separate challenge of prospective quantum threats on the industry’s radar.

?FAQ

01Who receives the bounty for solving the seed mystery?

The $36,864 bounty will be awarded to the Internet Security Research Group, the nonprofit organization behind Let’s Encrypt, which offers free website security certificates.

This article is for information only and is not financial advice.