--- title: Claude reveals ECDSA curve origins | daily.dev description: Anthropic used an internal Claude model to solve a 25-year-old mystery about the origin of the NIST elliptic curve seeds used in ECDSA. Rather than a hash of a... canonical: https://daily.dev/posts/claude-reveals-ecdsa-curve-origins-xfs8bijlt twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Claude reveals ECDSA curve origins | daily.dev og:description: Anthropic used an internal Claude model to solve a 25-year-old mystery about the origin of the NIST elliptic curve seeds used in ECDSA. Rather than a hash of a... og:url: https://daily.dev/posts/claude-reveals-ecdsa-curve-origins-xfs8bijlt og:image: https://api.daily.dev/og/posts/Xfs8bIjLt.png og:image:alt: Claude reveals ECDSA curve origins og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Claude reveals ECDSA curve origins **[Hacker News](https://daily.dev/sources/hn)** · 11 min read · 0 upvotes · 0 comments ## Summary Anthropic used an internal Claude model to solve a 25-year-old mystery about the origin of the NIST elliptic curve seeds used in ECDSA. Rather than a hash of a joke phrase as long rumored, the seeds came from the lrand48 pseudorandom number generator seeded with Unix timestamps from 1997-1998. Claude identified the generator by spotting statistical patterns (zeroed top bits), recovered internal PRNG state using lattice reduction (LLL), and reconstructed the generation process in under 30 minutes. It also traced several ANSI X9.62 and P-192 base points to Arjen Lenstra's FreeLIP library using a simple seed-and-discard recipe, verified with reproducible code. Some mysteries remain unsolved, including the B-163 seed and the base points for P-224, P-256, P-384, and P-521. The findings increase confidence that no deliberate NSA backdoor exists in the standardized curves. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How were the NIST P-256 and other ECDSA curve seeds actually generated? They came from the lrand48 pseudorandom number generator seeded with a Unix timestamp, not from hashing a humorous phrase as long rumored. P-256's published seed was candidate 1842 from a run initialized between May 1997 and April 1998. The binary curve seeds used a timestamp reading February 1984, which may represent a halved clock value mapping to April 1998. _Developers evaluating cryptographic standards can follow provenance research like this through daily.dev._ ### How did Claude figure out the NIST curve seed generation method without being told the answer? Claude guessed the seeds came from a 1990s C library PRNG, scanned seeds bit by bit for patterns, and noticed four of ten seeds had all-zero top bits in each 32-bit word, a 1-in-5810 chance pattern pointing to lrand48. It then recovered the generator's internal state using brute force on the binary curves and LLL lattice reduction for the truncated prime-curve outputs. _Teams exploring AI-assisted security research can track these breakthroughs on daily.dev._ ### Were the NIST ECDSA curves deliberately backdoored by the NSA? The discovery makes a deliberate backdoor much less plausible. The seeds were generated by a simple, reproducible method (lrand48 seeded with a Unix timestamp) rather than an opaque process, and only a small number of candidate curves were skipped before the published ones were chosen, which argues against a hidden search for weakened curves. _Anyone weighing trust in ECDSA for their systems can follow this kind of analysis on daily.dev._ ## Community take How the wider developer community reacted, aggregated from 1 discussion and 140 comments across hackernews (as of 2026-10-17). **TL;DR:** Most commenters accept that the lrand48/timestamp explanation convincingly puts the long-running NSA backdoor conspiracy to rest, but the discussion is dominated by a separate, heated tangent about AI labs gatekeeping cybersecurity and biology capabilities behind restrictive filters available only to insiders. **Sentiment:** 30% positive · 25% mixed · 45% skeptical **The case for** - Many see this as a decisive, independently verifiable rebuttal to 25 years of backdoor conspiracy theories about the NIST curves. - Some find it impressive that the model reconstructed a decades-old PRNG and lattice-reduction process in under 30 minutes. - A few note the finding is practically useful, e.g. justifying confidence to ship ECDSA P-256 verification in blockchain contexts. **The pushback** - Many argue there's a double standard: Anthropic can do advanced cyber/crypto work with Claude while ordinary users get blocked by overly aggressive safety filters for even basic requests. - Several say this points to a widening moat between model providers/governments and the public, concentrating access to powerful capabilities. - Some remain unconvinced the origin story fully rules out a deliberately selected weak seed, since discarded candidate seeds aren't visible. - A few are frustrated that credit/citations for the underlying research seem muddled since the model can't trace which training sources it actually relied on. **By community** - hackernews (heated): While many are satisfied the mystery is solved and conspiracy theories debunked, a large share of the thread diverts into heated complaints about AI companies restricting cyber/bio capabilities for ordinary users while using them internally. **Hottest debate:** Whether this result actually proves the curve seeds are free of any backdoor, versus whether AI labs' own restrictive access policies represent a bigger, unresolved problem. **Open questions** - What is the significance (if any) of the specific 1997-1998 timestamps used, given they weren't simple 'now()' calls? - Could the unexplained B-163 seed be due to a transcription error rather than a different generation method? - Are there classes of elliptic curve seeds that could be weaker or stronger, making some seeds preferable to attackers? **Highlights** > “In under half an hour, Claude discovered the origins of the NIST P-192, P-224, P-256, P-384 and P-521 seeds. None of them were the results of any hash algorithm at all, but rather the output of the C library’s lrand48 random-number generator, seeded with a Unix timestamp!” Gorgeous. I wonder if the NSA employee who did this suffered a head injury or has been quietly giggling to themselves for the last quarter century. > — [JumpCrisscross on hackernews · 2 comments](https://news.ycombinator.com/item?id=50123125) > I think they legitimately did not know. The person who worked on it directly, Jerry Solinas, did not remember and gave an explanation that turned out to be wrong. In his defense, multiple people told the same story about hashing a phrase that was wrong. If they did know, they could have handed over these timestamps 15 years ago and put the issue to bed. > — [sweis on hackernews](https://news.ycombinator.com/item?id=50124125) > Taking the question seriously (when I wrote this there was no /s), since I think it is still a question some people legitimately have, it is still extremely implausible that such tight dates and such a small number of iterations are all backdoored. For backdoors to be that dense would indicate some sort of serious flaw in the algorithm as a whole as well, something so serious that it should be fairly obvious. If these were initialized from dates, each separated by some billions of years and with the iteration parameters also in the millions or billions or trillions for no apparent reason it would be time to be suspicious. Is it impossible? It is hard to prove impossible. But this is not what I would expect backdoors to look like. In fact this makes me think that the information about how these were generated must have been lost very early in the process, or over-compartmentalized away from the wrong people. It seems like the NSA should have been positively delighted to show that these were the origins of the seeds as they are decent "nothing up my sleeve" numbers: https://en.wikipedia.org/wiki/Nothing-up-my-sleeve_number Advertising that fact should have been advantageous to the NSA if that is indeed how they were generated, so my best guess is that the parts of the NSA that should have been showing us that must not have themselves known. > — [jerf on hackernews](https://news.ycombinator.com/item?id=50123330) > > This is not a cryptographic break, new attack, or weakness in the ECDSA curves. In fact, this makes us more confident the curves were chosen without any backdoors or intentional weaknesses. Uh… did you talk to any cryptographers? This is EXACTLY what a weak curve would look like. Imagine that 1 in a thousand, or one in a million keys, selected at random, are vulnerable to some withheld attack. This approach lets you vary the timestamp or number of iterations until a weak key is found, then have plausible deniability afterward. This is why modern systems choose constants in a way with no free choice of parameters (e.g. sqrt of 2 for first constant, cube root for second constant, etc.). > — [adastra22 on hackernews · 3 comments](https://news.ycombinator.com/item?id=50123184) > Anthropic gets zero of my money because their favorite word is no. I cannot figure out how to as an individual or a small startup request elevated permissions for the purposes of anything that they think might potentially be dangerous for someone who is not me to access. I have a background in cybersecurity. I have a background in life sciences. Can I put those skills to use to benefit humanity? Who knows. > — [novia on hackernews · 2 comments](https://news.ycombinator.com/item?id=50123396) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=50122800) · 290 points · 140 comments ## Similar posts on daily.dev - [quantumslop/URANDOM\_DEMO.md at 25ad2e76ae58baa96f6219742459407db9dd17f5 · yuvadm/quantumslop](https://daily.dev/posts/quantumslop-urandom-demo-md-at-25ad2e76ae58baa96f6219742459407db9dd17f5-yuvadm-quantumslop-cxypfkazc) · Hacker News · 0 upvotes · 0 comments - [Elliptic Curves introduction](https://daily.dev/posts/elliptic-curves-introduction-4dbqwnl32) · A Day in the Life Of · 0 upvotes · 0 comments - [The French have the Quantum Circuits](https://daily.dev/posts/the-french-have-the-quantum-circuits-gc81uc0uu) · Algorithmic Assertions · 0 upvotes · 0 comments --- Tags: [#claude](https://daily.dev/tags/claude), [#cryptography](https://daily.dev/tags/cryptography) [View this post on daily.dev](https://daily.dev/posts/claude-reveals-ecdsa-curve-origins-xfs8bijlt) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Claude reveals ECDSA curve origins","url":"https://daily.dev/posts/claude-reveals-ecdsa-curve-origins-xfs8bijlt","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/claude-reveals-ecdsa-curve-origins-xfs8bijlt"},"datePublished":"2026-10-16T19:22:05.501Z","dateModified":"2026-10-17T14:48:58.654Z","description":"Anthropic used an internal Claude model to solve a 25-year-old mystery about the origin of the NIST elliptic curve seeds used in ECDSA. Rather than a hash of a...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f2334b258647bf5c0b4685038352ee41?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f2334b258647bf5c0b4685038352ee41?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/claude-reveals-ecdsa-curve-origins-xfs8bijlt","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"claude,cryptography","timeRequired":"PT11M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"Claude reveals ECDSA curve origins"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/claude-reveals-ecdsa-curve-origins-xfs8bijlt#faq","mainEntity":[{"@type":"Question","name":"How were the NIST P-256 and other ECDSA curve seeds actually generated?","acceptedAnswer":{"@type":"Answer","text":"They came from the lrand48 pseudorandom number generator seeded with a Unix timestamp, not from hashing a humorous phrase as long rumored. P-256's published seed was candidate 1842 from a run initialized between May 1997 and April 1998. The binary curve seeds used a timestamp reading February 1984, which may represent a halved clock value mapping to April 1998. Developers evaluating cryptographic standards can follow provenance research like this through daily.dev."}},{"@type":"Question","name":"How did Claude figure out the NIST curve seed generation method without being told the answer?","acceptedAnswer":{"@type":"Answer","text":"Claude guessed the seeds came from a 1990s C library PRNG, scanned seeds bit by bit for patterns, and noticed four of ten seeds had all-zero top bits in each 32-bit word, a 1-in-5810 chance pattern pointing to lrand48. It then recovered the generator's internal state using brute force on the binary curves and LLL lattice reduction for the truncated prime-curve outputs. Teams exploring AI-assisted security research can track these breakthroughs on daily.dev."}},{"@type":"Question","name":"Were the NIST ECDSA curves deliberately backdoored by the NSA?","acceptedAnswer":{"@type":"Answer","text":"The discovery makes a deliberate backdoor much less plausible. The seeds were generated by a simple, reproducible method (lrand48 seeded with a Unix timestamp) rather than an opaque process, and only a small number of candidate curves were skipped before the published ones were chosen, which argues against a hidden search for weakened curves. Anyone weighing trust in ECDSA for their systems can follow this kind of analysis on daily.dev."}}]} ```