Claude solves where NIST's P-256 curve seeds came from

Your P-256 keys are fine. What should get your attention is how fast a model found the answer.

Anthropic's Frontier Red Team said on Oct. 16 that an internal Claude research model worked out where the seeds for five NIST elliptic curves came from: P-192, P-224, P-256, P-384 and P-521.

The seeds had been assumed to be hash outputs. Anthropic says they were not. They came from lrand48, a random number generator in the C library, seeded with a Unix timestamp.

Under half an hour, after people had tried

Anthropic says Claude found it "in under half an hour," after Anthropic employees had chased the theory that the seeds were hashes of a phrase without success.

The model guessed the generator, scanned the seeds for its signature and recovered its hidden state. For the prime curves it used the LLL lattice reduction algorithm. The timestamps behind the prime-curve seeds fall between May 1997 and April 1998, according to the post.

Claude also traced the base points of P-192 and five ANSI X9.62 example curves to a second generator, from the FreeLIP library.

Anthropic is clear about what this is not: "This is not a cryptographic break, new attack, or weakness in the ECDSA curves." It goes further and says the result "makes us more confident the curves were chosen without any backdoors or intentional weaknesses."

The $36,864 bounty for finding the seeds goes to the Internet Security Research Group, Anthropic says.

A boring answer is good news

Unexplained seeds are exactly what keeps backdoor theories alive. A stock generator and a clock is about the most boring explanation possible.

In cryptography, boring is the good outcome.

It is not fully solved. Anthropic lists what remains open: the base points for P-224 through P-521, the base points of the binary curves, the seed for the binary curve B-163, and why some valid candidate seeds were skipped. P-256, for example, used candidate 1842 even though candidate 876 also produced a valid curve.

What it means for you

If you maintain code that uses these curves, there is nothing to change. Keep your curves.

If you run security, take the other half of the lesson. A model recovered a generator's state from its output faster than a meeting. The same skill applies to weak random numbers, guessable tokens and the old code nobody has read in years. This is a red teaming tool now, for you and for attackers.

It rhymes with today's OpenAI reports, where models found and forged unverified tokens on live sites. Models are getting good at spotting the shortcut someone left in the code.

Watch the base points

Watch whether Claude, or the researchers now working on it, explain the remaining base points and the skipped candidates. If anyone ever made a deliberate choice in these curves, that is where it would hide.

Keep P-256. Audit your randomness.