Claude traced NIST's mysterious ECDSA curve seeds to a 1990s random number generator

The zero bits that gave the generator away

Anthropic's write-up closes a long-running puzzle: where do the seeds of the NIST elliptic curves come from? A popular theory held that they were hash outputs. Claude's hypothesis was blunter: a weak random number generator common in 1990s C libraries. It wrote a scanner to look for that generator's output in the published seeds and noticed that the top bits of some seeds were all zero, the signature of lrand48, which returns only the top 31 bits of a 48-bit state. The odds of that pattern by chance were about 1 in 5,810.

For the four binary-curve seeds, recovering the generator state meant brute-forcing 17 hidden bits. The prime-curve seeds keep fewer bits per output, so Claude recovered the state with LLL lattice reduction. The recovered timestamps for the prime curves fall between May 1997 and April 1998. Claude also explained the base points of six curves (P-192 and five ANSI X9.62 example curves): they come from the generator in the FreeLIP arbitrary-precision library, seeded with small integers such as 20000 and 20420.

What is still unexplained

This is not a cryptographic break. Anthropic's argument is that reproducible seeds make a backdoor less plausible, since anyone can now regenerate them. Open items remain: the B-163 seed, and the base points for P-224, P-256, P-384, P-521 and the NIST binary curves. One oddity: candidate 876 in the P-256 search was also a valid curve, yet the published seed was candidate 1842. The $36,864 bounty for finding the seeds goes to the Internet Security Research Group, and the reproduction code is CC0.

The thread: who gets to run this?

The top-voted worry was access rather than cryptography.

"Anthropic (and whoever Anthropic wants) can do this kind of work with Claude, but if you or I try to do it, we will get blocked." — a commenter worried about a widening moat

Several people with direct experience disagreed.

"I worked on this specific task myself, using Claude, and I was not blocked (although I did not succeed!)" — a commenter who attempted the same seed hunt

"JFYI, this is not true. I do stuff like this all the time." — a commenter who runs similar analyses

A third camp had no patience for the gatekeeping at all.

"Anyone can do this kind of work with a model as simple as GLM 5.3 or Kimi K3" — a commenter pointing to open-weight models

The complaint with the most personal stakes came from someone who says they have cybersecurity and life-sciences training and cannot work out how to request elevated permissions: Anthropic gets zero of their money because its "favorite word is no."

Whether or not the block is real, the episode shows a gap in how access is perceived. A result that rests on a documented, open-licensed method was cheap to verify, yet the argument it triggered was about permissions. If you do security research and have been refused on dual-use work, the cyber-program route a commenter described is the one worth checking first.