C49D3608 86E70493 6A6678E1 139D26B7 819F7E90
The 160-bit hex string above is the core seed parameter for curve P-256, an elliptic curve securing billions of connections across the global internet. On October 15, 2026, Filippo Valsorda’s $36,864 community bounty was claimed by a team of researchers at Anthropic. A mystery that puzzled cryptographers for over a quarter of a century had been solved in half an hour by their internal research model, Claude. The entire prize was donated to the Internet Security Research Group (ISRG).
The breakthrough succeeded by shifting the underlying hypothesis space. For decades, the cryptographic community assumed the seeds were SHA-1 hashes of classified English passphrases—an assumption that led researchers astray for over twenty years. Instead of brute-forcing passphrase dictionaries, the model investigated the behavioral signatures of legacy pseudo-random number generators (PRNGs), reconstructing 10 seed sequences across 1,600 bits to deliver a mathematically definitive closure.
Looking in the Wrong Direction for 25 Years
In 2000, NIST adopted ECDSA curves in the FIPS 186-2 standard, including five prime curves spanning P-192 to P-521. Each curve came with a hexadecimal seed value used to deterministically hash and generate curve parameters. Submitted by the NSA, these critical seeds were published without explanation of how they were derived. That black-box origin immediately triggered an enduring crisis of trust across academia.
The most persistent rumor pointed to NSA researcher Jerry Solinas, suggesting he had hashed humorous English phrases with SHA-1 to generate the seeds. When Solinas passed away in 2023, the trail for verifying that oral tradition went cold. The community burned substantial compute cycles attempting to brute-force dictionary phrases to match hash prefixes—wasting valuable time exploring an unsubstantiated blind alley.
The lack of transparency allowed backdoor suspicions to fester over the years. In 2015, Neal Koblitz and Alfred Menezes published a comprehensive history of doubts surrounding the seeds. In 2017, Daniel J. Bernstein and Tanja Lange pointed out that the seed selection process contained roughly 70 bits of freedom—theoretically enough latitude to search for curves with hidden vulnerabilities. The suspicion eroded confidence in standard cryptographic building blocks across the industry for more than a decade.
Seeking closure, independent researcher Filippo Valsorda set up a $36,864 community bounty. While traveling in Taiwan, he picked up 20 dice from a FamilyMart convenience store, stamped them with “Geomys FIPS 140-3 Entropy Source” as merch, and mocked the mystical aura of the standard seeds with a single roll of 6^20 (~51.7 bits) of physical entropy. As long as the generation code remained irreproducible, community suspicion of the standard would never dissipate.
Figure: 20 dice purchased from a FamilyMart in Taiwan, yielding 6^20 (~51.7 bits) of entropy in one roll. Source: Filippo Valsorda
Reconstructing in 30 Minutes: Seeds Born from a 1997 Clock
In October 2026, Anthropic researchers presented the unsolved problem to an internal Claude model. The prompt offered no hints, asking the model to deduce the origins of the seeds from scratch. Surprisingly, the model pinpointed the answer in under thirty minutes. The dramatic speedup came from refocusing analysis on the structural behavior of standard generators.
Claude wrote an automated scanner testing 34 PRNG and bit-slicing combinations. While examining byte layouts, it noticed an anomalous statistical fingerprint: when splitting the 10 published seeds into 5 32-bit integers, the highest bits of all 20 integers in four specific seeds were zero. In a uniformly distributed byte sequence, the probability of such an occurrence is only 1 in 5,810. Such a bias could not be coincidental; it had to stem from the structure of the generator algorithm itself.
This statistical signature pointed directly to lrand48(), a standard Unix C library function widely used throughout the 1990s. The function maintains a 48-bit internal state but returns only the top 31 bits per call. Because the high bit of the return value is zero-padded, it left an unmistakable trace in the sequence. Recovering a single-step internal state required enumerating only the 17 unrevealed lower bits, narrowing the search space to 131,072 possibilities.
For prime curve seeds with more complex truncation, the model constructed a lattice basis reduction solver on the fly. Recovering the state of truncated linear congruential generators (LCGs) is a canonical lattice reduction problem. The model applied basis reduction across different truncation windows. The results proved that all 10 seeds followed an lrand48() >> 23 truncation pattern. Each recovered 48-bit state deterministically reproduced all 160 bits of the corresponding seed.
Figure: The highest bits of certain seeds were all 0—a signature of lrand48 returning the top 31 bits of a 48-bit state (random probability: 1/5,810). Source: Anthropic
1,600 Bits of State Fully Replayed
Because linear congruential generators possess bidirectional symmetry, knowing the internal state allowed the model to step backward along the recurrence formula. The algorithm searched for states consistent with standard srand48(t) initialization, where the lowest 16 bits are hardcoded to 0x330E. This backward trace anchored an otherwise arbitrary byte sequence back to physical time.
The backward derivation yielded precise historical clock readings. The initialization timestamps for the 10 prime curve seeds clustered tightly between May 1997 and April 1998. The pivotal P-256 seed aligned with a timestamp of August 16, 1997 at 01:52:34 UTC. The generation script drew candidate seeds in 20-byte batches after initialization; P-256 happened to land on the 1,842nd candidate. Deterministically replaying 1,842 consecutive iterations ruled out any chance of coincidence.
When analyzing the four binary curve seeds, the model encountered a temporal anomaly: the backtraced timestamp pointed to February 1984. However, doubling that timestamp shifted the date neatly to April 17, 1998—just two weeks away from when the P-224 seed was created. The engineer writing the script had almost certainly divided the system clock value by two.
The reproduction experiments yielded indisputable verification: all 1,600 bits across 10 seed sets matched historical standard outputs. In its reasoning transcript, Claude even recorded moments of self-doubt, wondering if it had been placed into an engineered sandbox puzzle. A global probability check across the ten states confirmed the discovery: the seeds came from a weak PRNG seeded by system time. That left virtually zero room for deliberate backdoor manipulation.
Figure: Seed generation mechanism: each iteration drew 20 bytes from the RNG as a candidate seed; P-256 was accepted on the 1,842nd candidate. Source: Anthropic
Base Points Partially Solved, Candidate Skips Remain Open
Alongside the seed breakthrough, the derivation of base points saw partial resolution. Analysis indicated that the base points for six elliptic curves generated in May 1997 originated from FreeLIP, a multiprecision arithmetic package developed by cryptographer Arjen Lenstra and incorporated into early versions of the NTL library. Curve P-192 used a base point seed of 20000, while several ANSI standard curves used discrete inputs like 20420 and 20507.
A few historical engineering gaps still remain unexplained. The seed derivation for curve B-163 has yet to be reproduced, and the exact base point generation rules for core curves like P-224 and P-256 remain unknown. Additionally, the original generation script skipped several valid candidates: candidate 876 for P-256 already met all standard criteria, yet the script bypassed it and continued searching until candidate 1842.
Cryptographers have long debated candidate skipping. Proponents of backdoor theories argue that discarding valid candidates allowed the author to filter for hidden algebraic weaknesses. Conversely, systems engineers suspect the skips were caused by undocumented performance heuristics, such as filtering out curve parameters with higher computational overhead. In the informal engineering culture of the late 1990s, ad-hoc filters were rarely documented.
Nevertheless, these remaining ambiguities do not undermine the central conclusion. Even if base point motives warrant further historical inquiry, the exact match of 1,600 PRNG bits with Unix timestamps drastically confines the possibility of an intentional backdoor.
LLMs as Hypothesis Generators
Reflecting on the discovery, the mathematical tools required were not esoteric—lattice reduction and LCG state inversion have been textbook techniques for decades. Human researchers stalled because their underlying hypothesis deviated from reality: the community had locked itself into the assumption of a high-entropy cryptographic hash, rendering existing algebraic tools inapplicable.
The primary advantage of large language models in scientific research lies in their capacity to broaden the hypothesis space. Unburdened by human attachment to the Jerry Solinas folklore, the model systematically constructed a broad testing matrix. Treating sloppy 1990s system code as a first-class hypothesis, it wrote quick validation scripts that converged open-ended speculation into high-confidence certainty.
This outcome illustrates a realistic role for LLMs in scientific discovery: models do not need to invent new mathematical theorems to make breakthroughs. Their core value lies in serving as hypothesis generators and automated scanners that swiftly navigate neglected branches of a problem.
The 25-year mystery of the NIST elliptic curve seeds is finally solved. What stalled cryptographers for over two decades was an upfront assumption frozen in place. Unencumbered by urban legends, the machine treated crude 1990s C library calls as a genuine candidate—a leap in perspective far more valuable than any algebraic trick.
References:
- Anthropic: Finding the origin of the NIST elliptic curves
- Filippo Valsorda: The 36 Ki$ ECDSA seed bounty (claim announcement and technical notes)
