Anthropic says an internal Claude model traced the seed values for five NIST elliptic curves to a common C-library random-number generator initialized with Unix timestamps. Those published seeds help determine one coefficient of each curve, but the reconstruction does not explain every parameter used by the curves.
The seeds helped define curves used for signatures
Elliptic Curve Digital Signature Algorithm (ECDSA) uses mathematical curves to generate and verify digital signatures. NIST added ECDSA and recommended elliptic curves in its 2000 Digital Signature Standard. The published curve parameters included seed values, but their origin was not documented, leaving cryptographers to ask whether the choices could have been deliberately manipulated.
A seed is an input to a procedure, not the curve itself. For the curves at issue, NIST described a method in which a hash of the seed determines coefficient b, one part of the equation that defines a curve. A curve’s other parameters, including its base point, must also be specified. The curve seed is therefore different from the secret, per-signature randomness used when someone creates an ECDSA signature.
Claude linked the seeds to a C generator initialized with timestamps
Anthropic says an employee asked its internal research model to find how the seeds were produced without giving it the rumored clue that they came from a hashed phrase. Claude instead proposed that the original program used lrand48, a pseudorandom-number generator found in C libraries, and worked backward to timestamp-based initialization values.
Under that reconstruction, the program drew 20 bytes at a time as candidate seeds, then tested the resulting curves. Anthropic reports that P-256’s published seed was the 1,842nd candidate in one run. It says the model found timestamp-based origins for the seeds associated with P-192, P-224, P-256, P-384 and P-521 in under half an hour. This is a reconstruction reported by Anthropic; its post does not describe an independent replication.
The reconstruction leaves parts of the parameter history open
Anthropic says the finding is not a break of ECDSA and does not call for users to change their systems. Because the method gives a reproducible explanation for how the five published seeds were generated, the company says it makes deliberate weakening of those curves less plausible. It does not show that every possible parameter choice was innocuous.
The post says some candidate curves were skipped for reasons the researchers could not determine. It also leaves the B-163 seed unexplained and does not identify how the base points for P-224, P-256, P-384 or P-521 were selected. The result narrows one long-standing provenance question; it does not settle the full history of every NIST curve.
Sources
- Anthropic: Claude reveals ECDSA curve origins
- NIST: FIPS 186-2 Digital Signature Standard (2000 edition; later withdrawn)
- NIST: Development of FIPS 186 and elliptic-curve standards
- Image: “ECClines.svg,” by SuperManu, licensed CC BY-SA 3.0; general elliptic-curve illustration, not the NIST parameters discussed here.