By asahifile 
A $36,864 internet bounty opened in 2021, asking who could explain the origin of the “seeds” — tiny constants whose hash values set the shapes of the elliptic curves that protect a substantial part of the world’s cryptographic traffic. For over a quarter century it had gone unclaimed. This month, Anthropic published an answer on a new research note, using an internal research model of Claude to do much of the legwork. On this case, it turns out Elliptic Curve cryptography was not a four-decade conspiracy but a timestamp from 1997 or 1998. That has important implications for long-suspected musings about the NSA.
The starting point is remarkable. The legacy NIST ECDSA parameters — P-192, P-224, P-256, P-384, P-521, among others — each come with a published seed value whose hash ### defines one coefficient of the curve. As cryptographers Neal Koblitz and Alfred Menezes documented in a 2015 survey, those values were provided by the NSA with no explanation available in the designs, and the community’s sympathy grew over the following decades: should we consider the seeds random, or could some of them be backdoors?
Finding the answer
The Anthropic team first tried to follow the best-repeated story — that a long-time NSA employee, Jerry Solinas, had generated the seeds from a hash of a humorous passphrase like “Give Bob and Jerry a raise.” Solinas died in 2023, leaving no reproducible records, and Anthropic employees spent months on that lead without pinning it down.
When an internal research model was asked the pure open question — how these seeds could be generated — it changed tack. Instead of guessing passphrases, it asked what software was likely to have produced them in the 1990s. A strong general pattern in the published seeds turned out to be visible to the human eye once you knew what to look for: the top bits of the curve-generation process showed a “columns of all-zero” structure that matched the output of a 1990s-vintage C library generator, lrand48, which had been seeded by a Unix timestamp.
To prove it, the researchers used lattice reduction (specifically Lenstra–Lenstra–Lovász, or LLL) to recover the hidden internal state of the old-era generator from the published curves. In the final step they found the seeds matched directly: each seed corresponds to a massive run of the 2000-era pseudo-random number generator whose seed argument is a Unix timestamp from May 1997 through April 1998.
What it does and doesn’t tell us
The upshot is that the seeds meaningfully predict that no backdoor was installed. Reconstructing the process fully, using a method anyone can verify — no secret instructions, no missing ingredient — confirms that the parameters were chosen at random at that timestamp, rather than by the process that the surrounding 1990s paperwork had described. The new work thus shuts a door that has been creaking open for years in public debates about backdoored cryptographic standards.
What it does not mean is that the machinery had been lurking undetected. The curve was already trusted by academia and industry; nobody was going to switch their production TLS certificates over from P-256 on the mere possibility of a backdoor. But absence of a proven-era-provenance documentation paper trail has been a credibility gap for regulators, for auditors, and for every cryptographic library maintainer who had to answer a skeptic. That gap has now been closed with a paper trail instead of an uncovered statement.
What the episode says about AI as a research tool
The reason this is genuinely interesting has very little to do with the final answer. It is that solving this puzzle required a distinctive mix of capabilities, and the researchers at Anthropic deliberately did not route that puzzle through a human assistant — they looked first at what an AI research model could do as a curious specialist. On a live open problem, it noticed a pattern, hypothesised the right era of machinery, chose the correct class of lattice algorithm, and worked through the math step-by-step until a single numerical check completed.
That will not translate to every open problem. The field of standards history suitably rewards exact reproduction from public paperwork, and the ECDSA seeds presented an unusually narrow lattice-structure puzzle on which an LLM could excel. But the result should reshape how we think about the uses of AI in checking existing claims. A problem the community had circled for 25 years, narrowed by cryptographic criticism, turned out to succumb purely to documentation-level conjecture.
What to watch
- Whether standards bodies refresh documentation of parameter provenance in future specs, regardless of the role AI played
- Whether Anthropic publishes details verifying the lattice machinery the research model produced, so others can reproduce the technique
- Whether the approach — AI-assisted recovery of a numeric constant from legacy documentation — is tested against similar lingering standards suspicions, such as other NIST-era parameters that remain unexplained
- How cryptographers respond, formally, to the possibility of reproducible generation widening the community trust story around new parameter standards
Sources: Anthropic, “Claude reveals ECDSA curve origins,” Frontier Red Team, October 16, 2026; Neal Koblitz and Alfred Menezes, “A Riddle Wrapped in an Enigma” (IACR ePrint, 2015); Jerry Solinas’s 2015 email, quoted by Anthropic.