Pull to refresh
Logo
What Changed
Following Why Sign Up
Anthropic team solves NIST curve seed mystery, claims bounty

Anthropic team solves NIST curve seed mystery, claims bounty

New Capabilities

Seeds traced to 1990s timestamps, not forgotten phrases; $36,864 donation goes to Let's Encrypt's nonprofit parent

October 29th, 2026: Let's Encrypt nonprofit welcomes seed discovery

Overview

Updated Nov 1

The seed numbers behind NIST's elliptic curves came from the C library's lrand48 random number generator, seeded with Unix timestamps from 1997 and 1998. The long-running tip that they were hashes of a humorous phrase was wrong.

A ten-person Anthropic team traced the method with Claude in under half an hour and claimed Filippo Valsorda's bounty, tripling it to $36,864 for ISRG, the nonprofit behind Let's Encrypt. On October 29, Let's Encrypt said the finding strengthened confidence in encryption used across much of the web. Because the seeds came from a clock, whoever picked them had barely 30 bits of freedom, too little to hunt for a deliberately weak curve.

Why it matters

The last credible backdoor theory against NIST's curves, which secure much of the web, is ruled out by arithmetic.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

$36,864
Bounty claimed and donated to ISRG
The team's choice to donate tripled the $12,288 prize to $36,864.
5
NIST prime-field curve seeds recovered
P-192 through P-521 seeds traced to lrand48 output seeded by Unix timestamps.
~30
Bits of freedom available to seed selection
Too small to target a hypothetical class of weak curves, ruling out the Bernstein-Lange technique.
1842
Candidate number that produced P-256's seed
P-256's standardized seed was the 1,842nd 20-byte candidate tested from its timestamp run.
1
Residual unexplained seed
B-163 still fits nothing; four other binary seeds trace to halved timestamps reading February 1984 (doubled, April 1998).
6
Base points traced to the FreeLIP generator
P-192 plus five ANSI X9.62 example curves; P-224, P-256, P-384, and P-521 base points do not fit the recipe.

Voices

Curated perspectives — historical figures and your fellow readers.

Sign up to generate historical perspectives on this story.

Log in Sign Up

People Involved

FV
Filippo Valsorda
Independent cryptographer who posted the seeds bounty in 2023
Verified the Anthropic team's solution and announced the claim
JS
Jerry Solinas
NSA mathematician who generated the NIST curve seeds (1997-98)
Deceased; died early 2023 without disclosing the method

Organizations Involved

National Institute of Standards and Technology
National Institute of Standards and Technology
US federal agency
Publisher of FIPS 186-2, which standardized the curves

The US agency that standardized the five P-curves in FIPS 186-2 in 2000.
Anthropic
Anthropic
AI company
Ten-person team solved the seed mystery using Claude

AI lab whose research team traced the seed generation method in under half an hour.
IS
Internet Security Research Group
Nonprofit
Recipient of the bounty donation

Nonprofit that operates Let's Encrypt, which issues free encryption certificates for a large share of the web.
National Security Agency
National Security Agency
US signals intelligence agency
Employer of Jerry Solinas; central to backdoor speculation

The US agency where Solinas generated the NIST curve seeds.

Timeline

1997 October 2026

10 events Latest: October 29th, 2026 · 1 week ago
Tap a bar to jump to that date

  1. Let's Encrypt nonprofit welcomes seed discovery

    Latest Announcement

    ISRG, the nonprofit that runs Let's Encrypt, published an article thanking the Anthropic team for the $36,864 donation and saying the result strengthens confidence in web encryption.

  2. Discovery announced publicly

    Announcement

    Valsorda publishes full details on his blog, confirming the lrand48 method with a Go reimplementation. The five prime seeds are traced; B-163 and the P-224, P-256, P-384, and P-521 base points remain unknown.

  3. Base point and binary seed details published

    Discovery

    Anthropic's post also traced the P-192 and ANSI X9.62 base points to the FreeLIP/NTL random number package, and traced four binary curve seeds to halved timestamps reading February 1984 (doubled, April 1998). B-163 and the P-224/256/384/521 base points remain unexplained.

  4. Anthropic team claims the bounty

    Discovery

    Ten Anthropic researchers use Claude to trace the seeds to drand48 and claim the bounty, tripling the donation to $36,864 for ISRG.

  5. Jerry Solinas dies

    Obituary

    The only person known to have known the seeds' origin dies without disclosing it.

  6. Valsorda posts the seeds bounty

    Announcement

    Cryptographer Filippo Valsorda offers a $12,288 bounty for anyone who can determine how the NIST seeds were generated.

  7. Bernstein and Lange outline a 70-bit freedom technique

    Analysis

    They describe how seed-selection freedom could have targeted a hypothetical class of 2^61 weak curves, keeping the backdoor question alive.

  8. Paper argues NSA backdoor is implausible

    Analysis

    Koblitz and Menezes publish 'A riddle wrapped in an enigma,' arguing the NSA could not have selected a weak seed that escaped 15 years of cryptanalysis.

  9. NIST publishes the P-curves in FIPS 186-2

    Publication

    The five prime-field curves P-192 through P-521 become a federal standard. The seeds and their generation method are not disclosed.

  10. Solinas generates the NIST curve seeds

    Origin

    NSA mathematician Jerry Solinas generates seeds using the lrand48 random number generator seeded with Unix timestamps, between May 1997 and April 1998.

Scenarios

1

B-163 seed and P-curve base points recovered

Possible Resolves by End of 2028

Discussed by: Filippo Valsorda, Anthropic research team

Two loose ends remain: the binary curve seed B-163, which fits nothing Claude tried, and the undocumented base points for P-224, P-256, P-384, and P-521. A follow-up effort could post a new bounty for these. The base points likely came from a similar script; the B-163 seed may trace to an older system or a different initializer.

2

Community accepts the finding; no challenge emerges

Likely Resolves by End of 2027

Discussed by: Cryptographic research community

No peer-reviewed paper disputes the timestamp derivation. Valsorda's verification in Go stands, and the NIST curves are treated as unbackdoored as the community shifts attention to post-quantum signatures. This matches the pattern of the 2015 Koblitz-Menezes analysis, which also concluded backdoors were implausible.

3

Skipped candidates spark a fresh audit

Unlikely Resolves by End of 2028

Discussed by: Cryptographic research community

Anthropic counted eleven viable prime-order curves that were passed over before the published seeds: one on the P-256 run, three on P-224's, and seven more across the two ANSI X9.62 example runs. If a researcher finds a deliberate pattern in the skipping, questions could reopen. The likely explanation is an artifact of the generation script, and Valsorda noted that even generous assumptions about the skips leave an attacker only around 30 bits of freedom.

4

Remaining P-curve base points traced to FreeLIP-style generation

Possible

Discussed by: Anthropic research team

P-192 and the ANSI X9.62 example curves trace their base points to the FreeLIP/NTL package's generator. P-224, P-256, P-384, and P-521 do not fit that recipe. A follow-up could model other 1990s packages, or a fresh bounty could target these four base points.

Historical Context

3 moments from history that rhyme with this story — and how they unfolded.

2006-2014

Dual_EC_DRBG (2006-2014)

NIST standardized a random number generator, Dual_EC_DRBG, in 2006 whose parameters were widely suspected to hide an NSA backdoor. The 2013 Snowden leaks suggested NSA influence, and the algorithm's output was potentially predictable to anyone knowing a secret relationship between the constants.

Then

NIST recommended against using Dual_EC_DRBG in September 2013 and withdrew it from the SP 800-90A standard in 2014.

Now

The episode deeply damaged trust in NIST cryptographic standards and fed suspicion of other parameter sets, including the elliptic curves.

Why this matters now

The same suspicion that sank Dual_EC_DRBG attached to the P-curves' undisclosed seeds. This resolution removes the equivalent doubt for the curves.

June 2013

Snowden leaks reveal NSA cryptography programs (2013)

Edward Snowden leaked documents describing the NSA's Bullrun program, a $250 million annual effort to weaken encryption standards, influence standards bodies, and insert backdoors into products.

Then

Widespread distrust of US cryptographic standards followed, and several companies accelerated encryption improvements.

Now

The leaks cemented a public narrative that the NSA could not be trusted with parameter selection, keeping the NIST seed question alive for over a decade.

Why this matters now

The leaks are the root cause of the conspiracy theories the bounty was designed to end. The timestamp finding directly contradicts the strongest version of those theories.

1993

Blowfish 'nothing up my sleeve' numbers (1993)

Bruce Schneier generated the S-boxes for the Blowfish cipher using the digits of pi, a transparent method anyone could verify. This established the 'nothing up my sleeve' tradition of choosing cryptographic constants from publicly known values.

Then

Blowfish was adopted widely, with no credible backdoor concern about its constants.

Now

The tradition became the norm for cipher design, making opaque parameter generation like the NIST seeds the exception and a red flag.

Why this matters now

The NIST curves were generated behind closed doors, the opposite of the Blowfish approach. The discovery shows the seeds were simple timestamps all along, not concealed weaknesses.

Sources

(10)
+4
Filippo Valsorda's blog Anthropic Hacker News Lobsters The Defiant TLDR Tech Unite.AI CoinDesk The Decoder Let's Encrypt