The NIST curve seeds were a 1990s random-number call and a clock. That is the boring, reassuring answer.

For twenty-five years the most paranoid question in applied cryptography had no answer at all: where did the numbers come from? The NIST elliptic curves that guard a large share of the internet's signatures shipped with a "seed" parameter and no explanation of how it was chosen. On October 16, Anthropic's Frontier Red Team published a post claiming the seeds were never hashes of anything. They were the output of lrand48, a random-number generator that shipped with 1990s C libraries, initialized from a Unix timestamp. Short scripts on the page regenerate every seed listed and six of the base points.

The claim splits cleanly, and the split is the story. One half is arithmetic anyone can rerun on a laptop. The other half — that an internal research model reached it in under half an hour, unaided in any way a reader can inspect — cannot be checked from outside at all.

What the seeds were supposed to be

ECDSA entered the US standard in 2000 as part of FIPS 186-2. For each curve over a prime or binary field, the specification printed a seed whose hash defines the curve coefficient b, and the seeds arrived from the NSA with no derivation and no justification. The P-256 seed, the one guarding most of the modern web, was this and nothing more:

C49D3608 86E70493 6A6678E1 139D26B7 819F7E90

That is the entire public record of its provenance. Neal Koblitz and Alfred Menezes wrote the canonical account of the resulting suspicion in their 2015 paper, which is careful not to accuse anyone of anything. An amateur investigator tried to reconstruct them and failed; Filippo Valsorda put up a bounty for whoever could. Nobody did, for years.

The passphrase story sent everyone the wrong way

The best available explanation came from inside the NSA. Jerry Solinas said in 2015 that the seeds were a hash of a humorous passphrase, roughly "Give Bob and Jerry a raise" or "Bob and Jerry rule"; Bob Reiter wrote the code; neither man remembered the details. Solinas died in 2023, and with him went the last firsthand account.

Anthropic staff chased that lead and came up empty: there was no hash. In October 2026 an employee asked an internal research model whether it could work out how the seeds were generated, without passing along the passphrase rumor. According to the post, it took under thirty minutes.

The giveaway was twenty zero bits

The approach was to assume the generator, not the message: a 1990s-vintage C library PRNG. The model wrote a scanner that slid along each published seed one bit at a time, testing whether adjacent chunks were consecutive outputs across 34 combinations of generator and output slice.

Then it noticed the top bits. Four of the ten seeds, written as twenty 32-bit words, carried a zero in the top bit of every word. Chance would produce that about once in 5,810 seeds. It is the signature of lrand48, which returns only the top 31 bits of a 48-bit state, so the leading bit is always clear. Recovering the state meant trying all 2^17 values of the hidden bits and checking whether the next four words followed. For all four seeds, they did.

The prime-curve seeds kept fewer bits per output, and state recovery from a truncated linear congruential generator is a textbook lattice problem, solved with the Lenstra–Lenstra–Lovász algorithm. Ten seeds — five NIST, five from ANSI X9.62 — all matched the pattern lrand48() >> 23. Each recovered 48-bit state regenerates all 160 bits of its seed.

Curve	Generator seed (UTC)	Candidate index
P-192	1997-05-18 14:45:34	139
P-256	1997-08-16 01:52:34	1,842
P-384	1997-08-30 14:50:08	2,688
P-521	1997-08-08 01:12:04	1,136
P-224	1998-04-03 12:52:07	7,026

Running the generator backwards is as easy as forwards, so each state could be stepped back to the form srand48 would have written, with the low 16 bits equal to 0x330E — a form that recurs every 65,536 steps. For all ten prime-curve seeds, that initialization was a Unix timestamp between May 1997 and April 1998. The four binary-curve seeds read as February 1984 until the timestamps were doubled, which lands them on April 17, 1998, two weeks after the P-224 run. The program may have halved the clock.

What anyone can check, and what nobody can

The scripts are thirty-odd lines and dedicated to the public domain under CC0. Run them and the printed seeds match the published ones character for character. The base points fall out too: six curves from May 1997 draw x-coordinates from the generator inside FreeLIP, Arjen Lenstra's long-integer package, seeded with small integers — 20000 for P-192, 20420 through 20517 for the ANSI curves. For prime192v1 it takes two tries, and checking any of it needs no trust in Anthropic — just an interpreter.

The unverifiable half is the framing. "An internal research model," "under half an hour," "without pointing at the clue" — none of it is observable from outside. The post lists ten authors, which is the honest part of the tell: models do not get bylines, and the human work of framing the question well enough to be answerable is exactly what disappears in the retelling. How much of the search the model originated is not something a reader can audit. Nor has anyone outside Anthropic reviewed the finding; rerunnable code is a strong substitute for peer review, but not the same thing.

Anthropic has published model-assisted research with the same shape of credit before, including its red team's work on exploit generation and Claude's claimed percolation proof, where the checkable artifact and the unevaluated framing also arrived together.

The uncomfortable part is not a backdoor

A weak PRNG seeded by the clock means the seeds were reproducible by anyone with the right idea for twenty-nine years. The reason nobody reproduced them is not that the search was hard: it was pointed at the wrong thing — a passphrase, a hash, a counter, a memory. The answer was sitting in a man page.

That reframes what the mystery was ever about. The seed is not key material: b is published and anyone can verify the arithmetic. What was unknown was intent — whether the parameters had been steered toward something weak. A deterministic, dull, clock-driven generator makes steering much less plausible, and Anthropic leans on that: "This is not a cryptographic break, new attack, or weakness in the ECDSA curves. In fact, this makes us more confident the curves were chosen without any backdoors or intentional weaknesses."

The company is careful about the residual. Someone who wanted a specific property could have searched over timestamps — worth doing only if you meant to disclose the timestamp later as evidence of innocent generation.

The loose ends Anthropic left open

Not every candidate made a usable curve, and some usable ones were passed over. P-256's published seed is candidate 1,842, but candidate 876 of the same run also yields a prime-order curve of the right size. P-224's run skipped three such curves and the ANSI runs seven more, and nobody knows the criteria. The fifth binary seed, B-163, fits nothing anyone tried. So do the base points of P-224, P-256, P-384 and P-521. The $36,864 bounty goes to the Internet Security Research Group.

The funniest artifact in the post

Mid-derivation, the model's own reasoning turns on itself:

Hmm wait. Let me be skeptical: am I in some sort of simulated/test environment? … All top bits clear—20 bits, chance 1e-6. So indeed real-world. Wow, it's a real discovery.

A system trained on an internet's worth of hoaxes had to argue itself into believing its own arithmetic, then had a second wobble about why nobody had found something so obvious in twenty-five years. It settled that the right way, by checking the bits rather than the vibes.

The useful lesson is smaller than the headlines will make it. A well-posed question, a cheap test, and a willingness to distrust the received story are what ended a quarter-century of speculation. The curves are fine. The seeds were always reproducible. Nobody had simply tried the clock.