Claude Traces Five NIST Curve Seeds to 1997 and 1998 Timestamps

The discovery regarding the NIST curve seeds, made public on October 16, successfully connected five sets of cryptographic starting numbers back to legacy computer software utilizing timestamps from 1997 and 1998. Anthropic stated that its research model managed to reconstruct their provenance in less than half an hour, drawing renewed attention to a decades-old NSA mystery.

This breakthrough involves how widely adopted NIST elliptic curves were originally generated, rather than representing an attack capable of compromising cryptocurrency wallets. While Bitcoin (BTC) relies on an entirely different curve, the finding has reignited discussions surrounding Satoshi Nakamoto’s design choices and the overall transparency of standards that secure digital information.

The Mystery Began With NSA Numbers in the 1990s

Back in 1997, mathematician Alfred Menezes was provided with curve seeds by Jerry Solinas, an NSA mathematician. By 2000, NIST officially adopted a collection of these NSA-provided curves—including P-256—without disclosing the exact method the agency used to select the initial numbers.

Although the seeds were publicly available, experts worried that the NSA might have sifted through numerous alternatives until finding parameters containing a hidden vulnerability that only the agency could exploit.

Those suspicions intensified following Edward Snowden’s disclosures, which tied the NSA to initiatives aimed at weakening cryptographic standards. Consequently, NIST withdrew the Dual EC random-number generator from its recommendations, prompting researchers to push for a verifiable and reproducible explanation for how the curves were chosen.

In their 2015 paper titled “A Riddle Wrapped in an Enigma,” Menezes and fellow cryptographer Neal Koblitz explored the controversy. By that point, what started as a technical question regarding parameter selection had evolved into a lasting debate over whether government-backed cryptography deserved public trust.

Records Requests and a Bounty Failed to Resolve the NSA Curve Seeds

Security researcher Steve Weis spent years attempting to uncover an explanation, which included filing public-records requests in 2018. According to CoinDesk’s coverage of the investigation, NIST reported having no relevant documentation, while the NSA ceased replying.

One prominent theory proposed that Solinas generated the seeds using a humorous phrase that he eventually forgot. Investigators tested various combinations of words in an effort to regenerate the published numbers based on that premise.

Later, in 2023, cryptography engineer Filippo Valsorda and fellow contributors launched a $12,288 bounty to find a solution. That amount eventually climbed to over $36,000 provided the winner donated the funds to charity. Because Solinas passed away earlier that year, researchers had to rely strictly on the existing numbers and the recollections of others.

The task was unusually specific: they needed to find a procedure that could recreate values that were already public. Rather than trying to recover a user’s private key, researchers were attempting to explain how a standard came to be.

How the Claude NIST Curve Seeds Were Rebuilt With an Old C Generator

Earlier this month, an employee at Anthropic directed an internal research model to look into the matter. By omitting the previous theory about a forgotten phrase from the prompt, the model was free to explore alternative pathways.

Claude successfully tracked the seeds for P-192, P-224, P-256, P-384, and P-521 back to lrand48, which is a random-number generator found in legacy C software libraries. The initial input was supplied by Unix timestamps.

For the P-256 curve, the model successfully generated a sequence featuring an exact match to the published seed. This timestamp-driven approach provided investigators with a concrete, rerunnable explanation, trading the hunt for a memorable phrase for a reproducible program.

Anthropic noted that this reconstruction makes a deliberate engineering of weaknesses far less probable, though questions remain regarding why certain usable candidates were bypassed and how other components of the curves were chosen.

A clear distinction exists between public parameters and private secrets in this context. While predictable randomness would pose a severe danger if utilized by a wallet to establish a private key—potentially allowing anyone who figured out the generation time to recreate the key and steal funds—these particular NIST seeds were published openly as part of the curve designs.

Ledger’s Joke Pulled Satoshi Back Into the Argument

Nicolas Bacca, co-founder of Ledger, reacted to the discovery by posting “Checkmate Satoshi,” which drew a reply from Adam Back, the CEO of Blockstream. Their online exchange broadened the scope of the technical breakthrough, tying it into longstanding conversations about Bitcoin’s architecture.

As detailed in coverage by U.Today, Back remarked, “That’s the NSA’s fault for not revealing the reproducible steps to generate their NIST published curves.” Bacca responded by noting that it still made for a good joke.

Pete Kim, lead for Coinbase wallet, also connected the discourse to Bitcoin and Ethereum’s preference for secp256k1 over P-256. Kim attributed that design decision largely to apprehension surrounding a potential NSA backdoor, and he praised Anthropic’s results.

Satoshi never formally documented the reasoning behind selecting secp256k1. Nonetheless, its simpler parameters have historically appealed to cryptographers because they restrict the flexibility of anyone designing a curve to hide a vulnerability.

Conversely, P-256 incorporates a large coefficient derived from a seed with previously unexplained origins. Uncovering the origin of that seed resolves the historical skepticism underlying the comparison, though it does not prove that Claude can break the cryptography of either curve.

The Bitcoin Security Question Now Shifts to Reproduction and Quantum Risk

For individuals utilizing NIST curves, Anthropic’s immediate recommendation is simple: no modifications are required. The practical next step for researchers involves rerunning the program to examine the execution path from the legacy generator to the published seeds.

Meanwhile, the distinct threat posed by quantum computing to Bitcoin remains active. A sufficiently advanced quantum computer could theoretically work backward from a known public key to determine the private key, completely independent of whether the underlying curve parameters originated from a transparent procedure.

Google announced this week that its Willow processor reduced error rates roughly 40-fold during one of the most resource-intensive steps such a machine would require. However, no quantum computer has yet achieved the scale and stability necessary to compromise a Bitcoin key, and there is no definitive timeline for when that might happen.

Consequently, the immediate takeaway for crypto holders is an evolution in historical security debates rather than an urgent need to migrate wallets. Claude’s successful reconstruction provides answers regarding the NSA’s legacy numbers while leaving the entirely separate challenge of future quantum threats on the industry’s radar.

FAQ

Who receives the bounty for solving the seed mystery?

The $36,864 bounty will go to the Internet Security Research Group, the nonprofit behind Let’s Encrypt, which provides free website security certificates.

Do I need to change my crypto wallets because of this discovery?

No, Anthropic’s research shows that the NIST curve seeds were generated using a standard timestamp-based process from the 1990s, meaning regular users do not need to alter anything or migrate wallets.

Does Claude’s discovery mean Bitcoin security is broken?

No, Bitcoin uses a different curve (secp256k1) and the discovery is about explaining how legacy NIST curves were created, not unlocking wallets or breaking modern encryption.

This article is for information only and is not financial advice.