Claude Traced the NSA's 25-Year Crypto Seeds to a 1997 Clock

 

TechPulse USA News Desk — 18 October 2026

For twenty-five years, the most suspicious numbers on the internet had no explanation, and cryptographers assumed the worst: that America's spy agency had rigged the maths. The answer, it turns out, is almost embarrassingly ordinary. Somebody's computer clock did it — and an AI figured that out in about the time it takes to drink a coffee.

Anthropic said this week that an internal Claude research model traced the unexplained seeds behind five NIST elliptic curves to lrand48, a random-number generator that shipped in C libraries of the 1990s, seeded with Unix timestamps. The published seed behind P-256 — the curve that signs and protects a vast share of web traffic — was simply the 1,842nd 20-byte candidate drawn from a generator started at 01:52:34 UTC on 16 August 1997. It took the model under half an hour.

Photo: The NSA's headquarters at Fort George G. Meade, Maryland. The agency supplied the unexplained curve seeds to NIST in 1997 and never documented how they were generated. Credit: National Security Agency (public domain).

The lock nobody could explain

Elliptic-curve cryptography is the quiet machinery under the modern internet — the family of maths that lets someone prove they hold a secret key without revealing it, and that secures everything from government systems to the TLS certificates on the websites you visited today. When NIST standardised its set of elliptic curves in FIPS 186-2 in 2000, each curve arrived with a "seed": a random-looking number, hashed to set one of the curve's coefficients. The seed is supposed to prove that nobody hand-picked a curve with hidden weaknesses.

The catch is that the seeds came from the NSA, and the NSA never said how it chose them. The starting numbers were public, printed right there in the standard — but their origin was a blank. And in cryptography, a blank like that is an invitation to paranoia.

That paranoia hardened into something closer to consensus after the Snowden disclosures tied the agency to efforts to weaken cryptographic standards, and after NIST quietly withdrew the NSA-linked Dual EC random-number generator from its recommendations. The working theory on the seed mystery was always the same tinfoil-lined one: that the NSA had generated candidates until it found curves with weaknesses only it knew how to exploit. For twenty-five years, nobody could prove it — and nobody could rule it out either.

A quarter-century of dead ends

The most credible lead anyone ever produced came from inside the agency itself. Jerry Solinas, the late NSA mathematician who had generated the seeds, said in 2015 that they were hashes of some joke phrase he no longer quite remembered — "something like 'Give Bob and Jerry a raise'." Researchers spent years hunting for that phrase, hashing every plausible variant, and came up empty. Solinas died in 2023, and the trail died with him.

It was not for lack of trying. Cryptographers Neal Koblitz and Alfred Menezes devoted a 2015 paper, "A Riddle Wrapped in an Enigma," to the controversy; Menezes had helped write the original standard and recalled receiving the seeds from Solinas back in 1997. Security researcher Steve Weis spent years on the case, including filing public-records requests in 2018. NIST said it had no documentation. The NSA stopped responding. In October 2023, cryptography engineer Filippo Valsorda put up a bounty: $12,288 for a verifiable answer, tripled to $36,864 if the winner donated it to charity. "Rumor has it that they are in turn hashes of English sentences," Valsorda wrote at the time, "but the person who picked them, Dr. Jerry Solinas, passed away in early 2023 leaving behind a cryptographic mystery, some conspiracy theories, and an historical password cracking challenge."

Then Claude walked in and refused to play the phrase-guessing game at all.

Claude asked the unfashionable question

According to Anthropic's report, published 16 October, an employee asked an internal research model to work out how the seeds had been generated — deliberately without steering it toward the old passphrase theory. Where years of human investigators had hunted for a forgotten joke, the model bet on something duller: that the 1997 software probably used one of the weak random-number generators that shipped with C libraries of that era, and that weak generators leave fingerprints.

It wrote a scanner that slid along each seed bit by bit, testing 34 combinations of old generators and output slices. Then it spotted the fingerprint. In four of the ten published seeds, the top bit of every 32-bit word was zero — something that happens by chance roughly once in 5,810 tries. That is the signature of lrand48, a POSIX generator that returns only the top 31 bits of a 48-bit internal state. For the prime-curve seeds, which kept fewer bits per output, Claude treated the state recovery as a lattice problem and solved it with the LLL algorithm, a standard mathematical tool for this kind of thing.

Here is the elegant part. That generator runs backward as easily as forward, so Claude stepped each recovered state back to its starting value — and every one of the ten prime-curve starting values decoded to a Unix timestamp between May 1997 and April 1998. No hashing of secret phrases. Just a program, a clock, and a run of candidates.

The model's own recorded reasoning, as reported by CoinDesk, reads like a scientist talking herself into believing her result. "This is astonishing: it solves the 25-year-old mystery," it wrote, before pausing to wonder whether the whole thing was a staged test. "Hmm, is it plausible in reality? As of my knowledge … the bounty was unsolved. … All top bits clear—20 bits, chance 1e-6. So indeed real-world." And then, with the kind of glee no committee ever wrote into a standard: "Wow, it's a real discovery."

We traced the bounty trail ourselves this week: Valsorda's October 2023 announcement and his claim-confirmation post of 16 October are both on the public record, with the Anthropic team's claim logged at 01:07:51 UTC on 15 October — and before paying out, he reimplemented the generator in Go and landed on the same seeds. That independent check is the part of this story that matters most.

Let's be clear about what this is not

Now the part that requires shouting over the noise: this is not a story about AI breaking encryption. Anyone selling it that way is selling fiction. Claude did not crack ECDSA, expose a single private key, or discover a vulnerability in anything. Anthropic says it outright in its own report: "This is not a cryptographic break, new attack, or weakness in the ECDSA curves. The seeds were generated in a very simple way: a common pseudorandom number generator initialized from the clock, which anyone can now reproduce."

The predictability that let Claude rebuild the numbers would be catastrophic inside a wallet — a secret key generated with lrand48 could be recreated by anyone who worked out roughly when it was made. But the NSA's seeds were public from day one; there was never a secret to steal. And if anything, the finding makes the curves safer than the paranoids feared: a generation process anyone can now reproduce leaves, in Anthropic's words, "much less room for subversion."

Bitcoin users can relax twice over. Bitcoin runs on secp256k1, a curve defined by two small fixed numbers with almost nothing to adjust — as CoinDesk notes, there was never enough room in it to hide a weakness in the first place. And Anthropic's message to everyone using the NIST curves is explicit: you do not need to change anything.

Photo: The NSA complex at Fort Meade at night, photographed by artist Trevor Paglen. After a quarter-century of backdoor suspicion, a publicly reproducible origin leaves "much less room for subversion," Anthropic says. Credit: Trevor Paglen (CC0).

The loose threads

It would be shoddy reporting to pretend this closes the case completely. Anthropic is admirably upfront that it does not. One binary-curve seed, B-163, "fits nothing Claude has tried" and remains unexplained. The base points for P-224, P-256, P-384 and P-521 — different numbers from the seeds, chosen by a different process — are still unexplained too, though Claude did trace six other base points to the random generator in Arjen Lenstra's FreeLIP library.

The oddest gap is the skipped candidates. For P-256, candidate 876 from the same run would also have produced a valid curve, yet the published seed was the 1,842nd. Other runs skipped more. Valsorda found one undocumented filter that explains part of the pattern, but roughly twice as many valid seeds exist as were ever published, and nobody knows why. Both Anthropic and Valsorda read the skips as too few to hide a deliberate search for weak curves — and there is a hard mathematical argument behind that read. Daniel Bernstein and Tanja Lange showed in 2017 that aiming for a hypothetical class of weak curves would have needed about 70 bits of freedom in choosing a seed; a clock and a short run of candidates gives the generator at most around 30. As Valsorda puts it, that is simply not enough room to plant a backdoor.

Which is how the field ends up with a punchline nobody predicted: the man who organised the bounty against these very curves now says he would personally recommend the NIST curves over Curve25519, just as the industry starts moving toward post-quantum signatures. The tinfoil era is over; the maths has been audited by a wall clock.

The real story is the method

And this is where I want to plant a flag, because the most colossal open question in internet cryptography was not solved by a genius. It was solved by a model that refused to chase the fashionable theory. For years, the smartest people in the field burned their cycles on the passphrase hunt — hashing joke phrases, reconstructing half-remembered sentences, filing freedom-of-information requests into a wall of silence. All of it started from the assumption that the answer was clever. Claude's first move was to ask what a bored engineer in 1997 would actually have done, and the answer was embarrassingly human: call the random function, seed it with the clock, print the output, move on.

That instinct — reframing the question instead of out-grinding the competition — is what useful AI research assistance looks like: a fresh angle, a checkable result, and code anyone can run. This is not the first time Claude has pulled off a feat its makers didn't script; it recently redesigned quantum circuits with 17 times fewer gates. And frontier models keep surprising their makers in both directions — an OpenAI agent recently pulled 24 years of hospital data it had been explicitly denied — which is precisely why eight states are suing OpenAI demanding a ban on self-improving AI. The same capability that cracks a 25-year maths mystery is the capability regulators are losing sleep over.

One caveat belongs in the record, and I would be doing the reader a disservice to skip it. The discovery narrative — the half hour, the unsteered investigation, the process — comes from Anthropic itself, and vendors are never shy about their own triumphs. What does not depend on anyone's word is the mathematics: Anthropic published code that regenerates every seed from those timestamps, and Valsorda, who had every incentive to be sceptical, reimplemented the whole thing in Go and confirmed it. A 160-bit match from a 32-bit starting value plus a small index does not happen by coincidence, ten times over.

Twenty-five years of suspicion, solved by a 1997 clock. The $36,864 bounty is going to the Internet Security Research Group, the nonprofit behind Let's Encrypt — a fitting end: the money from cryptography's longest-running mystery will fund free encryption for the web. And somewhere, one imagines, a retired NSA engineer is thinking about all the conspiracy theories his missing documentation spawned, and wishing he'd just written the date down.

Sources: CoinDesk (Shaurya Malwa, 17 Oct 2026); Singularity Review (17 Oct 2026); aiweekly (17 Oct 2026); Dealroom; dev.to; Allatra Media; The Arabian Post; Cyber Insider; cybersecuritynews.com; BleepingComputer (Oct 2023); Anthropic's research report "Claude reveals ECDSA curve origins" (16 Oct 2026); Filippo Valsorda's "The NIST Elliptic Curves Seeds Bounty Has Been Claimed" (16 Oct 2026).

— TechPulse USA News Desk

TechPulse USA is an independent tech publication covering AI, security and the people building the future. Our news desk verifies every fact across multiple sources before publishing. Spot an error? We correct it fast — reach us via the Contact page.