Anthropic says its model Claude reconstructed how the original seed values behind several widely used NIST elliptic curves were generated, resolving a question that had attracted suspicion for more than two decades. The identified process involved the C library's lrand48 generator and Unix timestamps. Anthropic stresses that the research does not reveal an attack on P-256 or other affected curves.
Why the seeds mattered
The NIST standards published the seed values without a convincing public account of how the numbers were chosen; the U.S. National Security Agency had supplied them. For years, that gap fed a low-grade unease among cryptographers. If no one could explain where the numbers came from, no one could rule out that they had been picked to hide a weakness. The curves themselves are woven into everyday security: elliptic-curve signatures underpin many kinds of account security, including passkeys and hardware-backed authentication. So the provenance of the seeds was never a purely academic question.
How Claude got there
Anthropic says the model worked backward from the published seeds to the generation method. In the case of P-256, it took 1,842 iterations through candidate outputs to reproduce the standardized seed. The work also examined P-192, P-224, P-384 and P-521. The mechanism Anthropic identified is mundane: the C library's lrand48 generator, fed with Unix timestamps. That is the kind of tool a programmer would have reached for in the 1990s, not a bespoke method designed to conceal anything. The reconstruction suggests the seeds were produced by an ordinary software process rather than chosen by hand.
What the finding does not mean
Recovering the seed-generation history is not the same as breaking a private key, proving the curve has a vulnerability or establishing that every implementation is safe. Anthropic itself says there is no urgent corrective action to take. The distinction matters. A curve can have a perfectly traceable origin and still be implemented badly somewhere. Conversely, an unexplained seed is not evidence of a backdoor. What the research does is close a question that had been open for over 20 years, replacing speculation with a concrete, reproducible account.
The suspicion that lingered
The NIST curves have been a fixture of cryptographic standards since the late 1990s. Their seed values were published, but the rationale behind them was not. That asymmetry — public numbers, private reasoning — is what kept the doubt alive. Anthropic's account doesn't rely on any insider document or confession. It relies on the fact that the seeds can be regenerated from the published values using a known generator and a timestamp. The 1,842 iterations for P-256 is a detail that makes the result checkable, not just plausible.
What happens next
Anthropic has not called for changes to the affected curves, and none of the standards bodies named in the research have issued new guidance. The finding is likely to be scrutinized by cryptographers who will try to reproduce the seed-generation process for each curve independently. Until that happens, the result stands as a strong claim from a single lab. The question that remains is not whether the curves are broken — Anthropic says they aren't — but whether the reconstruction holds up under outside review. For now, the practical advice from Anthropic is that there is nothing urgent to fix.
