Claude AI Solves NSA’s 25-Year Cryptography Seed Mystery

Deciphering a Quarter-Century Elliptic Curve Mystery

For more than two decades, the global cryptography community remained haunted by a foundational question of internet security: how did the National Security Agency (NSA) construct the initial parameters for its widely adopted elliptic curves? Each curve relied on an arbitrary 160-bit starting number called a seed. While researchers could systematically review the mathematical steps applied to produce the curves, the genesis of the seeds themselves remained completely obscure, fueling longstanding suspicions that the NSA had planted a covert backdoor to exploit down the line.

The controversy rose to academic prominence in 2015 when cryptographers Neal Koblitz and Alfred Menezes evaluated the dilemma in their paper, “A Riddle Wrapped in an Enigma.” For years, folklore within the discipline suggested that NSA mathematician Jerry Solinas had generated the parameters by computing mathematical hashes of humorous English phrases, such as “Jerry deserves a raise.” However, because the hardware used at the time was replaced and Solinas could not recall the exact input phrases despite attempts to recreate them, the true procedural origin remained unproven. In October 2023, independent cryptographer Filippo Valsorda introduced a $12,288 challenge reward—later tripled to $36,864 through charitable matching—to anyone who could mathematically explain the seed selection process.

How Claude Reverse-Engineered the NSA’s Seed Generation

The breakthrough arrived when an employee at Anthropic tasked an internal Claude research model with investigating the parameters without prompting it with the historical passphrase hypothesis. Published in Anthropic research on October 16, the analysis identified a critical structural anomaly: multiple seeds featured high-order bit sequences populated consistently by zeros. With only an estimated 1-in-5,810 likelihood of occurring purely by chance, the footprint matched the behavior of lrand48, a standard pseudorandom number generator ubiquitous in legacy Unix environments.

Working backward through the generator’s internal states, the AI system reproduced the published 160-bit seeds with absolute precision. The underlying seed inputs were not arbitrary phrases or custom NSA formulas, but standard Unix timestamps representing late-1990s dates. The AI model noted in its recorded reasoning log: This is astonishing: it solves the 25-year-old mystery. The entire automated analytical operation concluded in under 30 minutes.

Chronology of the Curves and Independent Verification

The reverse-engineering pipeline confirmed that the five standard NIST prime-field curves trace back to timestamps logged between May 1997 and April 1998. Specifically, the P-192 curve was generated from a timestamp originating on May 18, 1997. P-521 followed on August 8, P-256 on August 16, P-384 on August 30, and P-224 on April 3, 1998. The software workflow was simple: initialize the standard generator with the current time, yield candidate seeds, evaluate them against curve criteria, and repeat the cycle until viable parameters surfaced.

For curve P-256, the algorithm reached an acceptable candidate after 1,842 attempts, while P-224 required 7,026 candidate iterations. Cryptographer Steve Weis shared broader context on social media via a video explaining it. Filippo Valsorda replicated the findings using an independent implementation written in the Go programming language, while Anthropic open-sourced its code repository to ensure public verifiability across the wider security community.

Industry Reactions and Gregory Maxwell’s Skepticism

Despite widespread acclaim for the solution, Bitcoin core developer Gregory Maxwell voiced skepticism regarding the promotional narrative on Hacker News. Maxwell revealed he had suggested probing the very same cryptographic question on September 20 to an associate holding expiring Anthropic service credits, but that agent failed to achieve any breakthroughs after extensive runtime.

While Maxwell did not contest the mathematical validity of the findings or seek discovery credit, he questioned whether commercial model gating influenced performance variances across users: I’m not saying this to suggest that misanthropic hijacked someone elses work yet again– this is an obvious question that many people have surely posed and success presumably depended on expert use (which was absolutely not applied in my friends example), Maxwell stated. But it does make me wonder if the company invisibly degraded the model performance.

Why This Matters

Uncovering the generation method provides much-needed relief to systems architects and enterprise engineers relying on NIST elliptic curves for foundational transport encryption. The discovery drastically weakens the prospect of an intentional cryptographic trapdoor. Anthropic researchers determined that the algorithmic workflow restricted parameter freedom to approximately 30 bits—far beneath the roughly 70 bits of leeway an attacker would mathematically require to conceal an intentional, exploitable vulnerability.

The resolution does not alter public blockchain architectures such as Bitcoin or Ethereum, which depend on the secp256k1 curve rather than the NIST prime-field alternatives. Additionally, minor historical questions linger: the origin of binary curve B-163 remains unsolved, and it is still unclear why specific valid candidate seeds were bypassed during the NSA’s 1990s runs. However, the identification of Unix system clocks demonstrates that the mysterious seeds were fundamentally benign artifacts of standard 1990s software execution rather than deliberate intelligence sabotage. Concluding the challenge, Valsorda confirmed that the $36,864 reward was officially granted to the Internet Security Research Group (ISRG), noting that the research helps fill out a page of cryptographic history, and reinforces our confidence in these critical cryptographic primitives.

Frequently Asked Questions

Does this discovery impact Bitcoin or Ethereum security?

No. Neither Bitcoin nor Ethereum relies on the NIST curves evaluated in this discovery. Both major blockchain networks utilize secp256k1, an alternative Koblitz curve with entirely distinct mathematical parameters and properties.

Were the NSA’s elliptic curves backdoored?

The findings indicate an intentional backdoor is highly improbable. Because the seeds were output sequentially from an ordinary Unix random-number generator initialized with dates and times, NSA developers lacked the degrees of mathematical freedom needed to conceal known vulnerabilities within the curves.

Where was the $36,864 research bounty directed?

Filippo Valsorda’s community bounty was directed to the Internet Security Research Group (ISRG), the non-profit organization responsible for operating the Let’s Encrypt certificate authority, which provides free digital TLS/SSL certificates globally.