For over two decades, a cryptographic mystery hidden in plain sight has shadowed the digital security standards relied upon by billions of users worldwide. The U.S. National Security Agency provided a set of seemingly arbitrary numbers that formed the foundation of elliptic curve cryptography used in digital signatures across the internet. Cryptographers and security analysts speculated endlessly: were these numbers carefully chosen to contain a mathematical backdoor, or were they generated innocuously? Anthropic’s Claude AI has now delivered a definitive answer, tracing those numbers back to an ordinary random-number generator initialized with Unix timestamps from the mid-1990s. The discovery, published on October 16, closes one of the longest-running conspiracy theories in applied cryptography and reaffirms that the widely adopted NIST elliptic curves were not secretly weakened by their creators.
The Mystery That Would Not Die: NSA Seeds and the Backdoor Question
The numbers in question are the seeds used to generate five elliptic curves — including the pivotal P-256, P-384, and P-521 — that the National Institute of Standards and Technology (NIST) standardized in its digital signature algorithm (DSA) specification in 2000. The NSA supplied the seeds, but the agency never publicly explained how they were chosen. Any researcher could verify that a given seed produced the published curve parameters, but nobody could explain why that specific starting value was selected. That explanatory gap became a breeding ground for suspicion.
Anthropic’s Claude AI has now delivered a definitive answer, tracing those numbers back to an ordinary random-number generator initialized with Unix timestamps from the mid-1990s.
If the seeds were deliberately chosen to produce curves with hidden vulnerabilities, an attacker could potentially forge digital signatures, impersonate trusted entities, or decrypt communications that relied on those standards. Given the NSA’s historic interest in cryptographic superiority, many assumed the worst. The mystery persisted through years of analysis, even as the curves became foundational to TLS, SSH, Bitcoin, and countless other systems. Earlier investigations had gone down fruitless paths, including a hypothesis that the numbers were derived from humorous phrases. That lead turned out to be a dead end.
Claude Takes a Fresh Look at a Decades-Old Problem
Anthropic, the AI safety company behind the Claude model family, decided to apply its internal research model to the puzzle. Rather than brute-forcing possible seeds, Claude reasoned about the software environment in which the numbers were likely generated. The model hypothesized that whoever produced the seeds in the 1990s would have used a standard C library random-number generator, specifically lrand48, seeded with a Unix timestamp — a common programming practice at the time.
Claude then reverse-engineered the internal state of that generator by recognizing patterns in the output seeds, recovering the exact timestamps used across all five NIST curves. The results landed in a narrow window between May 1997 and April 1998. For instance, the seed for curve P-256 was reproduced using the timestamp corresponding to August 16, 1997, at 01:52:34 UTC, and then taking the 1,842nd candidate generated. The entire generation of all five seeds took under half an hour — exactly what one would expect from a developer running a script on a workstation of that era.
Anthropic published reproduction code, allowing independent verification of the recovery. Cryptographer Filippo Valsorda, who had previously organized a bounty for solving the mystery, reimplemented the generation algorithm in Go and confirmed the finding. Valsorda verified that the Anthropic team claimed the $36,864 bounty, directing the payout to the Internet Security Research Group (the organization behind Let’s Encrypt).
Why a Predictable Generator Does Not Break Security
At first glance, the revelation that the NSA used a predictable random-number generator might seem alarming. But the context is critical. The generator was used only to produce public mathematical parameters — not to generate private keys. The curves themselves were always public, and their security relies on the difficulty of the elliptic curve discrete logarithm problem, not on the secrecy of the seed. Knowing exactly how the seeds were generated does not allow an attacker to compute private keys, forge signatures, or decrypt traffic.
In fact, the discovery strengthens confidence in the curves. If the seeds had been crafted maliciously, an adversary would need to engineer the parameters to hide a vulnerability while still passing the standard public verification checks. The fact that the seeds came from a timestamped, non-malicious source eliminates the most plausible mechanism for a backdoor. As Anthropic noted, the findings show that the curves were selected without hidden weaknesses, effectively ending the speculation that has haunted these standards for decades.
What Is a Cryptographic Seed and Why Does It Matter?
A cryptographic seed is an initial input to a deterministic process that generates a larger set of numbers — in this case, the coefficients and base points defining an elliptic curve. The NIST standard required that the seeds be published so that anyone could independently compute the curve parameters and verify that no undocumented changes were made. The problem was that the seeds themselves appeared arbitrary, and without knowing how they were chosen, one could not exclude the possibility that the choice was engineered to match a rare, weak curve that only the NSA knew about.
Now, with the timestamps known, the generation method is fully transparent. Any cryptographer can rerun the same algorithm and confirm that the seeds are exactly the output of a 1990s-era C library call seeded with a date and time. This transforms the seeds from mysterious artifacts into mundane artifacts of software development practice.
Remaining Gaps: What Still Puzzles Researchers
While Claude’s reconstruction solves the core mystery, a few details remain unresolved. The generation process skipped over some candidate curves that appear to meet the mathematical requirements for the standard, and the researchers do not know why those candidates were discarded. There is also one seed from a separate family of curves that could not be explained by the same method, as well as the origins of several standardized starting points used in signature calculations (known as generators).
These gaps are minor compared to the fundamental question that has now been answered. The existence of unexplained seeds had been the strongest argument for a conspiracy; with that argument removed, the remaining anomalies are likely the result of undocumented decisions by the original developers — decisions that may never be fully reconstructed but that do not affect the security of the standards.
Broader Implications for Trust in Cryptographic Standards
The episode is a powerful case study in how even well-founded security skepticism can persist in the absence of transparency. The NSA’s silence about the seed generation process was not itself evidence of malice, but it created an information vacuum that suspicion readily filled. The cryptographic community did exactly what it should have done: it analyzed the curves, found no backdoor in the mathematics, but remained uneasy about the provenance of the seeds.
Anthropic’s success also highlights a new role for advanced AI models in security research. Claude did not simply brute-force possibilities; it reasoned about historical programming conventions and applied reconstruction techniques that a human cryptographer might have taken months to test. The model’s ability to navigate both the mathematical constraints and the contextual knowledge of 1990s software practices accelerated a process that had already stumped researchers for years.
For the broader ecosystem of internet security, this closure is timely. The NIST curves remain among the most widely used elliptic curves in the world. Confidence in their integrity is essential for the trust anchors of the web, from TLS certificates to code-signing keys. With the mystery resolved, developers and administrators can point to a clear, reproducible origin story for these numbers — one that involves a developer running a script in the late 1990s, not an elaborate trapdoor.
The story also serves as a reminder that cryptographic transparency demands more than publishing parameters. Publishing the exact method and seed values — even describing the throwaway programming choices — can prevent decades of doubt. As organizations continue to standardize new cryptographic primitives, the lesson is clear: documentation of how numbers were generated is as important as the numbers themselves.
Anthropic’s work does not just solve a historical puzzle; it provides a practical template for using AI to audit the foundations of security infrastructure. The same techniques could be applied to other unexplained constants in cryptographic standards, verifying that they, too, arose from mundane processes rather than deliberate manipulation. For now, the NSA’s cryptographic numbers have been fully accounted for, and the internet can breathe a little easier knowing that the foundations of its digital signatures are as trustworthy as the mathematics behind them.
- How were the NSA cryptographic seeds generated?The seeds were generated using the lrand48 random-number generator seeded with Unix timestamps from the mid-1990s.
- Why did cryptographers suspect the seeds contained a backdoor?The NSA never publicly explained how the seeds were chosen, leading to speculation about hidden vulnerabilities.
- What did Claude AI discover about the seeds?Claude AI reverse-engineered the seed generation process and traced them to ordinary random numbers from 1997-1998 Unix timestamps.
