The Claude cryptography mystery that puzzled researchers for roughly 25 years may finally have an answer. Anthropic says an internal Claude research model traced the origins of several unexplained NIST elliptic-curve seeds in under 30 minutes, linking them to an old C library pseudorandom-number generator initialized with Unix timestamps.
The discovery explains the origins of seed values used for NIST curves P-192, P-224, P-256, P-384 and P-521.
But one point needs to be clear from the beginning: Claude did not break ECDSA, expose private keys or discover a new cryptographic vulnerability. Anthropic says the finding instead makes deliberate manipulation of these particular curve seeds less plausible.
For broader coverage of emerging AI security research, see our AI Cyber Threats and Agentic Security Guide.
Key Technical Findings
- Anthropic says an internal Claude research model solved the long-running seed-origin question in under 30 minutes.
- The research explains seeds for NIST P-192, P-224, P-256, P-384 and P-521.
- The values were generated using the C library
lrand48pseudorandom-number generator. - The generator was initialized using Unix timestamps.
- The P-256 standardized seed was the 1,842nd candidate generated from its run.
- Claude used pattern analysis and LLL lattice reduction to recover generator state.
- The result is not a cryptographic break or a new weakness in ECDSA.
- The B-163 seed and several base-point origins remain unexplained.
How the Claude Cryptography Mystery Was Solved
The mystery dates back to the adoption of the Elliptic Curve Digital Signature Algorithm in NIST’s FIPS 186-2 standard in 2000.
The standard listed recommended elliptic curves and published seed values used as part of the curve-generation process.
What researchers did not have was a clear explanation for how those seeds had originally been selected.
Because the parameters had been supplied by the NSA without a documented derivation process, cryptographers spent years debating whether the values were generated randomly, derived from a hidden phrase or deliberately selected to create an undisclosed weakness.
No practical backdoor in these curves had been demonstrated, but the unexplained provenance kept the debate alive.
Claude Rejected the Long-Running Passphrase Theory
Researchers had previously pursued the idea that the seeds might have been derived from a humorous phrase or message associated with the engineers involved.
Anthropic says several employees had unsuccessfully searched for that explanation.
In October 2026, an Anthropic employee asked an internal research model to investigate the question without steering it toward that earlier theory.
Claude instead considered what software tools and random-number generators would likely have been available when the curves were created in the late 1990s.
That different approach led to the breakthrough.
Why lrand48 Became the Key Clue
Claude examined the published seeds and tested patterns associated with pseudorandom-number generators commonly found in older C libraries.
The model noticed that several seed values contained a distinctive pattern: certain high bits were consistently zero.
That behavior matched lrand48, a linear congruential pseudorandom-number generator that exposes only part of its 48-bit internal state.
Anthropic says Claude wrote a scanner that tested 34 combinations of older generators and output slices.
Once the lrand48 signature appeared, the model reconstructed candidate internal states and checked whether they regenerated the published seeds.
LLL Lattice Reduction Helped Recover the Prime-Curve Seeds
The prime-curve seeds were harder to analyze because only a portion of each pseudorandom generator output had been retained.
Claude used the Lenstra-Lenstra-Lovász, or LLL, lattice reduction algorithm to recover the state of the truncated linear congruential generator.
Anthropic says five NIST prime-curve seeds and five ANSI X9.62 example seeds showed the same pattern.
Each reconstructed 48-bit state reproduced the full 160-bit seed, making accidental matches extremely unlikely.
Unix Timestamps Explained the Generator State
After recovering the internal states, Claude ran the generator backward until it reached a state consistent with the way srand48 initializes lrand48.
The resulting initialization values mapped to Unix timestamps between May 1997 and April 1998.
Anthropic reported the following examples:
- P-192: May 18, 1997
- P-521: August 8, 1997
- P-256: August 16, 1997
- P-384: August 30, 1997
- P-224: April 3, 1998
For P-256, the published seed was the 1,842nd 20-byte candidate generated from that run.
What This Means for ECDSA Security
This discovery does not make ECDSA weaker.
Anthropic explicitly says the work is not a cryptographic break, a new attack or a newly discovered flaw in the curves.
Instead, the findings make the historical generation process easier to reproduce and explain.
If the seeds came from a simple pseudorandom generator initialized from the system clock, there is less unexplained freedom available for secretly manipulating those particular parameters.
That does not answer every historical question around the curves, but it removes one of the biggest sources of uncertainty.
No Security Update or Key Rotation Is Required
Organizations using P-256 or other affected NIST curves do not need to replace certificates, rotate signing keys or migrate cryptographic systems because of this research.
The seeds being discussed are public curve-generation parameters, not secret private keys.
Reconstructing their historical origin does not let an attacker forge digital signatures or recover protected credentials.
Claude Also Traced Some Elliptic-Curve Base Points
The research produced another result beyond the seed investigation.
Elliptic curves also use a fixed base point, commonly represented as G, which is used as the starting point for public-key calculations.
Anthropic says Claude traced the base-point generation process for P-192 and several ANSI X9.62 example curves to the random-number generator used in FreeLIP, an older long-integer arithmetic package.
The reconstructed process involved:
- Initializing the generator with a small integer.
- Discarding the first seven outputs.
- Generating candidate x-coordinates from 26-bit outputs.
- Repeating the process until a valid point on the curve was found.
Important Questions Still Remain
The Claude cryptography mystery is not completely closed.
Anthropic says the B-163 seed remains unexplained.
The origins of the base points for P-224, P-256, P-384 and P-521 are also still unknown.
Researchers additionally found cases where apparently acceptable curve candidates were skipped before the standardized value was selected.
For P-256, candidate 876 appears capable of producing a valid prime-order curve, while candidate 1,842 became the published seed.
Anthropic says it does not know why those earlier candidates were rejected.
Confirmed vs Still Unknown
Confirmed by Anthropic
- An internal Claude research model investigated the seed-provenance question.
- The model reproduced five major NIST prime-curve seeds.
- The seeds were generated using
lrand48. - Unix timestamps were used to initialize the generator.
- Claude used LLL lattice reduction during the reconstruction process.
- The P-256 standardized seed corresponds to candidate 1,842.
- Several ANSI X9.62 example seeds follow the same generation pattern.
- Some curve base points were traced to FreeLIP.
- The finding is not a new ECDSA vulnerability.
Still Unknown
- Why some earlier viable curve candidates were skipped.
- How the B-163 seed was generated.
- How the P-224, P-256, P-384 and P-521 base points were selected.
- Whether any additional unpublished selection criteria were used.
Why This Research Matters Beyond Cryptography
The Claude cryptography mystery also shows how frontier AI systems may accelerate highly specialized security research.
Claude did not simply summarize existing papers.
According to Anthropic, the model combined historical software reasoning, pattern recognition, code generation and advanced mathematics to build and verify a new explanation for the seed values.
This is different from routine vulnerability scanning because the task required reconstructing software behavior from decades ago and validating mathematical relationships across known cryptographic parameters.
CyberUpdates365 previously covered Claude Mythos 5 security scanning, where Anthropic’s models are used for enterprise vulnerability research. This ECDSA work demonstrates how similar AI capabilities can also contribute to deeper cryptographic investigations.
CyberUpdates365 Analysis
The biggest takeaway is not that Claude “broke cryptography.” It did not.
The more significant development is that an AI research system appears to have solved a specialized technical provenance problem that had remained unresolved for decades.
Claude had to form hypotheses, write code, reason about old software, reconstruct pseudorandom generator state and apply lattice mathematics before validating the result.
That makes the research relevant not only to cryptographers, but also to security teams evaluating how quickly frontier AI models may accelerate difficult technical investigations.
It also demonstrates why cybersecurity reporting needs careful wording.
A headline claiming that Claude “broke NSA encryption” would be inaccurate. Anthropic’s own conclusion is almost the opposite: the reconstructed process gives researchers more confidence in how these particular curve parameters were generated.
Research Evidence
- Research organization: Anthropic
- Publication date: October 16, 2026
- AI system: Internal Claude research model
- Reported research time: Under 30 minutes
- NIST seeds explained: P-192, P-224, P-256, P-384 and P-521
- Generator identified: lrand48
- Initialization: Unix timestamps
- Mathematical technique: LLL lattice reduction
- P-256 candidate: 1,842
- Cryptographic break: No
- Security action required: None
- Unresolved seed: B-163
Frequently Asked Questions
Did Claude break ECDSA?
No. Anthropic says Claude did not break ECDSA, expose private keys or reveal a new attack against the cryptographic standard.
What did Claude actually discover?
Claude reconstructed how several historical NIST elliptic-curve seed values were generated using the lrand48 pseudorandom-number generator initialized with Unix timestamps.
Why was this considered a mystery?
The seeds had been published without a clear explanation of how they were originally selected, leaving researchers uncertain about their provenance.
Were the curves secretly backdoored?
The research does not prove every historical design decision, but Anthropic says the newly reconstructed seed-generation process makes deliberate manipulation of these specific values less plausible.
Which curves were explained?
The seed origins for P-192, P-224, P-256, P-384 and P-521 were reproduced.
Does P-256 need to be replaced?
No. Anthropic says no security action is required because of this discovery.
Did Claude solve every unanswered question?
No. The B-163 seed and several curve base-point origins remain unexplained.
Final Takeaway
Anthropic’s research provides a reproducible explanation for one of the longest-running questions surrounding NIST elliptic curves.
Rather than revealing a hidden weakness, the findings suggest that several important ECDSA seeds were generated using a simple 1990s-era pseudorandom process initialized from system time.
That gives researchers a clearer historical explanation for parameters that had remained unexplained for decades.
The broader implication is just as important: frontier AI systems are beginning to contribute meaningfully to specialized cybersecurity and cryptography research, but their findings still require careful human verification and accurate reporting.
Want more verified AI security research?
See how Anthropic is using Claude for enterprise vulnerability research and code analysis.
Read: Claude Mythos 5 Security and AI Vulnerability Scanning →
