For 25 years, cryptographers debated the origins of five mysterious encryption seeds supplied by the National Security Agency, with theories ranging from hidden weaknesses to forgotten inside jokes. Anthropic's Claude AI recently traced the numbers to a straightforward source: timestamps from 1997 and 1998 processed through a standard Unix-era random-number generator.
The five curves—P-192, P-224, P-256, P-384, and P-521—were developed in the late 1990s as part of elliptic curve cryptography standards published by the National Institute of Standards and Technology (NIST). These mathematical curves became foundational to securing websites, financial transactions, and government communications.
Each curve relied on a 160-bit seed whose origin remained unexplained, fueling speculation about potential deliberate vulnerabilities. NSA mathematician Jerry Solinas, who reportedly supplied the seeds, recalled they had been generated by hashing humorous English phrases, but the exact phrases and original computer were lost to time.
In October 2023, cryptographer Filippo Valsorda offered a bounty for solving the mystery. A matching arrangement raised the potential payout to $36,864, which went unclaimed for three years.
The Solution
According to Anthropic's research published October 16, an internal Claude research model investigated the seeds without being told about the secret-phrase theory. The analysis identified a statistical pattern: several seeds contained groups of numbers with consistently zero highest bits, a pattern with roughly a 1-in-5,810 probability of occurring randomly.
This pointed toward lrand48, a pseudorandom number generator from Unix environments. Working backward through the mathematics, Claude recovered the generator's internal states and reproduced all 160 bits of the published seeds exactly.
The starting values corresponded to Unix timestamps from May 1997 through April 1998. P-192 originated from May 18, 1997; P-521 from August 8, 1997; P-256 from August 16, 1997; P-384 from August 30, 1997; and P-224 from April 3, 1998. The process took less than 30 minutes.
The apparent method was direct: initialize the random-number generator with a timestamp, generate candidate seeds, test them against mathematical requirements, and continue until an acceptable curve emerged. For P-256, the accepted seed appeared at candidate 1,842. For P-224, it took 7,026 candidates. Cryptographer Filippo Valsorda independently confirmed the findings using the Go programming language.
Implications for Security
The discovery reduces the plausibility of backdoor theories. Researchers estimated the NSA possessed roughly 30 bits of selection freedom under generous assumptions—substantially less than the approximately 70 bits contemplated in proposed weakness-selection scenarios.
The finding does not break elliptic curve cryptography or establish that all weaknesses have been ruled out. It also does not affect Bitcoin or Ethereum, which use a different elliptic curve called secp256k1.
Anthropic directed the bounty to the Internet Security Research Group, which operates Let's Encrypt. One remaining loose end: the origin of another curve's seed, B-163, remains unexplained.
