ResearchPublished All news from that day
Anthropic says an internal model traced NIST curve seeds to lrand48 and a timestamp, making a backdoor less plausible.
Anthropic's Frontier Red Team reports that the seeds behind the standard NIST elliptic curves come from an old random number generator seeded with a timestamp, not from a hash.
Check our sources · 11 facts from 1 sourceAnthropic published a research post on 16 October 2026 on where the seeds for the NIST elliptic curves came from. The seeds were published with the ECDSA standard in 2000, and their origin was never explained.
Anthropic says an internal research model, asked to work out the method without a hint, reached results in under half an hour. It found that the seeds for the prime curves P-192 to P-521 come from the lrand48 generator seeded with a Unix timestamp, not from a hash. The four binary-curve seeds appear to use a timestamp divided by two.
Anthropic states that this is not a cryptographic break or a weakness in ECDSA. It says the finding makes a deliberate backdoor in these seeds less plausible but does not prove there is none. The base points of several NIST curves are still unexplained, and the post includes Python code under CC0 that reproduces the seeds.
Underlined sentences link to the facts we checked. Dotted words open a short explainer.
Fact 6 of 11 · from Anthropic, 16 Oct 2026
In under half an hour, Claude discovered the origins.
Fact 10 of 11 · from Anthropic, 16 Oct 2026
dedicating it to the public domain under CC0 1.0 Universal.
Your reaction
We count reactions per story and day, never who reacted. The counts help us choose what goes in the monthly issue. If you are signed in, your own page shows yours too.
We count reactions per story and day, never who reacted. They help choose what goes in the monthly issue.
Check our sources
Every sentence above is checked against this source.
1 Claude reveals ECDSA curve origins
Open the source archived copy-
Anthropic published the research post 'Claude reveals ECDSA curve origins' on October 16, 2026, authored by members of its Frontier Red Team.
citeClaude reveals ECDSA curve origins
-
The post says NIST adopted ECDSA in 2000 (FIPS 186-2) and published a seed for prime and binary curves whose hash defines the curve coefficient b, with the NSA supplying seeds without explaining their origin.
citeIt was adopted by NIST in 2000 as part of the FIPS 186-2 Digital Signature Standard.
-
The post says the seeds for NIST P-192, P-224, P-256, P-384 and P-521 are not hash outputs but come from the C library's lrand48 generator seeded with a Unix timestamp.
citeNone of them were the results of any hash algorithm at all, but rather the output of the C library’s `lrand48` random-number generator, seeded with a Unix timestamp!
-
The post says the four binary-curve seeds appear to use a timestamp divided by two, which maps to April 17, 1998.
citeSo, the program may have halved the clock. With the timestamps doubled, they map to April 17, 1998
-
The post says the timestamps for the prime-curve seeds fall between May 1997 and April 1998.
citeevery srand48 initialization was a Unix timestamp representing a date between May 1997 and April 1998.
-
The post says an internal research model was asked to work out the generation method without being given the hint and reached results in under half an hour.
citeIn under half an hour, Claude discovered the origins.
-
The post says each recovered generator state regenerated all 160 bits of its seed.
citeEach recovered 48-bit state regenerates all 160 bits of its seed, which does not happen by chance.
-
The post says this is not a cryptographic break and that the findings make a deliberate backdoor much less plausible; it adds only that it is still conceivable the curves were chosen for a specific property. Say it makes a backdoor less plausible, never that it rules one out.
Toned down to what the source says
citeThis is not a cryptographic break, new attack, or weakness in the ECDSA curves.
-
The post says the base points for P-224, P-256, P-384, P-521 and the NIST binary curves remain unexplained, and that the fifth binary seed, B-163, is unexplained.
citeThe fifth binary seed, B-163, fits nothing Claude has tried and remains unexplained.
-
The post includes Python code that reproduces the seeds and base points, released under CC0.
citededicating it to the public domain under CC0 1.0 Universal.
-
The post says the $36,864 bounty for finding the seeds will be donated to the Internet Security Research Group (ISRG).
citeThe $36,864 for finding the seeds will be donated to the Internet Security Research Group.
Every sentence above is checked against this source. Each fact has its own address you can cite.
Source 1 · Anthropic · 16 Oct 2026
Claude reveals ECDSA curve origins
Anthropic published the research post 'Claude reveals ECDSA curve origins' on October 16, 2026, authored by members of its Frontier Red Team.
Claude reveals ECDSA curve origins
The post says NIST adopted ECDSA in 2000 (FIPS 186-2) and published a seed for prime and binary curves whose hash defines the curve coefficient b, with the NSA supplying seeds without explaining their origin.
It was adopted by NIST in 2000 as part of the FIPS 186-2 Digital Signature Standard.
The post says the seeds for NIST P-192, P-224, P-256, P-384 and P-521 are not hash outputs but come from the C library's lrand48 generator seeded with a Unix timestamp.
None of them were the results of any hash algorithm at all, but rather the output of the C library’s `lrand48` random-number generator, seeded with a Unix timestamp!
Show all 11 factsShow fewer facts
The post says the four binary-curve seeds appear to use a timestamp divided by two, which maps to April 17, 1998.
So, the program may have halved the clock. With the timestamps doubled, they map to April 17, 1998
The post says the timestamps for the prime-curve seeds fall between May 1997 and April 1998.
every srand48 initialization was a Unix timestamp representing a date between May 1997 and April 1998.
The post says an internal research model was asked to work out the generation method without being given the hint and reached results in under half an hour.
In under half an hour, Claude discovered the origins.
The post says each recovered generator state regenerated all 160 bits of its seed.
Each recovered 48-bit state regenerates all 160 bits of its seed, which does not happen by chance.
The post says this is not a cryptographic break and that the findings make a deliberate backdoor much less plausible; it adds only that it is still conceivable the curves were chosen for a specific property. Say it makes a backdoor less plausible, never that it rules one out.
Toned down to what the source saysThis is not a cryptographic break, new attack, or weakness in the ECDSA curves.
The post says the base points for P-224, P-256, P-384, P-521 and the NIST binary curves remain unexplained, and that the fifth binary seed, B-163, is unexplained.
The fifth binary seed, B-163, fits nothing Claude has tried and remains unexplained.
The post includes Python code that reproduces the seeds and base points, released under CC0.
dedicating it to the public domain under CC0 1.0 Universal.
The post says the $36,864 bounty for finding the seeds will be donated to the Internet Security Research Group (ISRG).
The $36,864 for finding the seeds will be donated to the Internet Security Research Group.
Topics
The morning email
On the mornings we publish: the three top stories and up to four short ones. Free.
We email you a link to confirm. An issue may include one sponsor, always labelled Sponsored · Advertisement. Our emails count opens and clicks, not who made them. Unsubscribe in one click. What we keep