For a quarter of a century, cryptographers have quietly wondered whether the US government buried a backdoor inside some of the most widely used encryption standards on the internet. Anthropic says Claude has now settled the question, and the answer turns out to be refreshingly boring: the numbers everyone was suspicious of were just generated from a clock.

The mystery behind the curves

Back in 2000, the National Institute of Standards and Technology (NIST) adopted ECDSA, now the most widely used elliptic curve cryptography standard, protecting everything from HTTPS connections to cryptocurrency wallets. Buried in that standard were a handful of “seed” values, odd strings like C49D3608 86E70493 6A6678E1 139D26B7 819F7E90 for the P-256 curve, that were used to generate the mathematical parameters of each curve. The seeds came from the NSA, with no explanation of where they came from.

That silence bred decades of suspicion. If the NSA had quietly searched through billions of possible seeds until it found one that produced a curve with a hidden weakness, there would be no way to tell just by looking at the final standard. Researchers Neal Koblitz and Alfred Menezes wrote a well-known paper on the controversy, an amateur investigator dug through old mailing lists trying to crack it, and cryptographer Filippo Valsorda eventually put up a cash bounty for anyone who could trace the seeds back to their source.

The best lead for years came from Jerry Solinas, the NSA mathematician who reportedly generated the curves, who said before his death in 2023 that the seeds came from hashing a joke phrase like “Give Bob and Jerry a raise.” Nobody could ever verify it, and the archives, if they existed at all, were gone.

What Claude actually found

According to Anthropic, an employee asked an internal research model in October 2026 to figure out how the seeds were generated, deliberately withholding the “humorous phrase” rumor that had sent human researchers down a dead end for years. Claude solved it in under half an hour: the seeds weren’t the output of a hash function involving any phrase at all. They came from lrand48, a weak pseudorandom number generator shipped with 1990s C libraries, seeded by nothing more exotic than a Unix timestamp.

Claude’s path to the answer was itself a small piece of applied cryptanalysis. It wrote a scanner to test whether the published seeds matched the output pattern of various 1990s-era generators, and noticed something odd: several seeds had their top bit cleared across all 20 bytes, a pattern that would occur by chance roughly once in 5,810 tries. That pointed to lrand48, which only returns 31 of its 48 bits of internal state. From there, Claude used lattice reduction (specifically the LLL algorithm) to recover the hidden state bits, then ran the generator’s logic backward until it landed on a value consistent with how the function is normally initialized. For all ten prime-curve seeds, that initialization value turned out to be a Unix timestamp between May 1997 and April 1998.

Anthropic even published the reproduction code: plug the relevant 1997 or 1998 timestamp into a loop around lrand48, run it for a few thousand iterations, and out comes the exact byte string that’s been sitting in the NIST standard since 2000.

Claude also partially cracked a second mystery along the way. Six of the curves’ base points, the fixed reference point every public key is built from, turned out to come from a different random number generator bundled with a 1990s long-integer arithmetic library. Nobody had explained those before either. The base points for the more commonly used P-224, P-256, P-384, and P-521 curves, along with one binary-curve seed, remain unexplained, so some loose ends are still open.

Why this matters more for reassurance than alarm

Anthropic is clear about the stakes here: there’s nothing to patch and nothing to do differently. If anything, the finding cuts the other way. A seed generated by deliberately searching for a weak curve would look essentially indistinguishable from the standard itself, so proving the seeds came from a simple, reproducible clock-based process rather than an opaque hashing scheme removes one of the few remaining reasons to suspect a deliberately planted backdoor. The $36,864 bounty for cracking the mystery will reportedly be donated to the Internet Security Research Group.

The result also lands in the middle of a run of findings in which Anthropic has used Claude for hard research problems well outside ordinary chatbot use, from uncovering a hidden biological system reminiscent of CRISPR to helping a Harvard mathematician disprove an 87-year-old conjecture in algebraic geometry. Anthropic has also been tracking just how much of its own internal research is now being run by Claude, and cases like this one, a 25-year-old open question solved in under 30 minutes, are the kind of anecdote that tends to show up in those internal metrics.