An Anthropic AI model has solved a cryptographic mystery that has puzzled researchers for 25 years, tracing numbers the NSA supplied to the U.S. government in the late 1990s to an ordinary random-number generator. The discovery took the model approximately 30 minutes to complete.
In 2000, the National Institute of Standards and Technology adopted a set of elliptic curves supplied by the NSA without explaining the origins of certain numbers used to generate them. These unexplained seeds fueled years of suspicion that the NSA had discovered a weakness in the curves that only it could exploit.
Elliptic-curve cryptography protects much of the internet, including bitcoin wallets, by allowing users to prove they hold a secret key without revealing it. The curves work like lock designs that anyone can inspect, but whose mathematical integrity must remain difficult to break.
After the Snowden disclosures linked the NSA to efforts to weaken cryptographic standards, questions about the curve origins intensified. Security researcher Steve Weis spent years investigating, filing public-records requests in 2018, but received no documentation from NIST and no response from the NSA. In 2023, cryptography engineer Filippo Valsorda and others offered a bounty of $12,288, later rising to over $36,000 if donated to charity.
Claude traced five NIST curve seeds to lrand48, a random-number generator found in older C software libraries, and reproduced the sequence behind P-256, a widely used curve. The model found an exact match for the published seed at the 1,842nd candidate.
Anthropic says the finding makes a hidden weakness much less likely, though questions remain about why the program passed over some usable candidates and how other parts of the curves were chosen. The NSA's seeds were public from the beginning, so there was never a secret to steal. Anthropic stated that people using the NIST curves do not need to change anything.
Bitcoin's separate curve
Bitcoin was not affected by this issue because it uses secp256k1, a simpler curve with almost no adjustable parameters, leaving little room for anyone to have quietly built a weakness into it. Creator Satoshi Nakamoto never publicly explained the choice, and the curve was rarely used before bitcoin made it famous. Ethereum later adopted it as well, and bitcoin retained it during its 2021 Taproot upgrade.
However, sufficiently powerful quantum computers could pose a separate threat to bitcoin by working backward from a public key visible on the blockchain to the secret key behind it, regardless of how the curve was chosen. Google said this week its Willow chip cut errors about 40-fold in one of the costliest steps such a machine would need. No quantum computer has yet been built large or reliable enough to crack a bitcoin key, and there is no clear timeline for when one might arrive.
The $36,864 bounty will go to the Internet Security Research Group, the nonprofit behind Let's Encrypt, which provides free security certificates to websites.
