Crypto
18 Oct 2026
Read 11 min
NIST P-256 seed origin explained How to verify Claude’s find *
NIST P-256 seed origin explained so you can reproduce Claude's find and confirm the curves are safe
An Anthropic research model traced the NSA’s mysterious NIST curve seeds to a standard lrand48 random-number generator seeded with 1997–1998 timestamps. NIST P-256 seed origin explained: this points away from a hidden backdoor and toward a reproducible process that anyone can re-run, with open questions left on why some candidates were skipped.
For 25 years, experts asked where the starting numbers for widely used NIST elliptic curves came from. This week, an AI model found a clear path: the seeds match outputs from lrand48, a common C library tool, when it uses specific timestamps from the late 1990s. That result lowers the odds of a secret weakness and lets researchers reproduce the process.
The result makes a hidden NSA backdoor far less likely.
NIST curve users do not need to change settings or software.
Some choices, like why certain candidates were skipped, are still unclear.
Bitcoin is safe here because it uses secp256k1, not P-256.
Quantum computing is a different, longer-term concern.
A computer with a C, Python, or Rust toolchain.
An implementation of lrand48 (many languages have one or an equivalent).
NIST’s public curve parameters for P-256 (to compare the published seed).
Basic hashing tools and big-integer support.
Set a search window. Use plausible timestamps from 1997 and 1998. Convert them to the form lrand48 expects for seeding.
Generate lrand48 outputs. For each timestamp, produce the needed stream of outputs to form a candidate seed with the right size.
Derive candidates. Apply the same derivation steps that NIST used when turning seeds into curve parameters, including any required hashing and checks. Keep only candidates that pass the published validity tests.
Compare with the published P-256 seed. Keep iterating through candidates. The published P-256 seed appears around the 1,842nd valid candidate in the reproduction reported by Anthropic.
Repeat for other NIST curves. The same method should map to the other four seeds the NSA supplied.
Document and share. Record your environment, library versions, and time sources to help other people match your run.
These steps map the public seed to a public process. They do not reveal private keys. They do not weaken current systems. They only show that the seed likely came from a standard generator plus a timestamp.
Use hardware wallets from trusted vendors.
Keep backups offline and secure.
Update firmware and software on schedule.
Avoid weak or reused passphrases.
Candidate selection: Why did the process skip some seeds that looked fine on paper?
Other parameters: How were the remaining parts of each curve chosen, beyond the seed step?
Documentation: Can agencies publish full, reproducible scripts next time so trust does not drift?
Independent runs: More public reproductions will add confidence and may settle the last gaps.
Expect fresh write-ups, reference code, and peer reviews in the coming weeks. The bounty tied to this search—$36,864—will go to the Internet Security Research Group, the nonprofit that runs Let’s Encrypt, which is a neat outcome for web users everywhere.
Trust in cryptography grows when choices are public, repeatable, and boring. With NIST P-256 seed origin explained by a reproducible lrand48 path, the community can focus on the parts that still need light and on new threats that matter more.
NIST P-256 seed origin explained: what changed in 2026
The 30-minute breakthrough
An Anthropic employee asked an internal model to look for a data trail. The model found that five NIST curve seeds, including the one behind P-256, line up with lrand48 outputs. It even located P-256’s seed at the 1,842nd candidate. This took less than half an hour. Anyone can now follow the same steps and hit the same match.Why lrand48 matters
lrand48 is old and predictable. It is fine for testing. It is bad for secrets. If someone used it to make a private key, a skilled attacker could guess the key from the time window and the generator’s math. Here, though, the seeds were public from day one and only guided how the curves were built. That is why this match does not put users at risk.A short history of the mystery
Seeds, standards, and suspicion
In 2000, NIST adopted elliptic curves the NSA supplied. The NSA did not explain how it chose the seeds used to generate those curves. After the Snowden leaks linked the NSA to weakened standards, trust dipped. NIST later removed the Dual EC random-number generator from its guidance. People then asked if these earlier curve seeds hid a trap.People who kept digging
Cryptographers Neal Koblitz and Alfred Menezes wrote a 2015 paper, “A Riddle Wrapped in an Enigma,” that mapped the doubts. Menezes recalled NSA mathematician Jerry Solinas sending the seeds in 1997. Researcher Steve Weis filed records requests. NIST had no notes. The NSA went quiet. A tip said a funny phrase might be the source, but that went nowhere. In 2023, Filippo Valsorda and others posted a bounty that later grew to $36,864 if donated to charity. The trail stayed cold—until now.How to verify Claude’s find yourself
If you want NIST P-256 seed origin explained in practice, you can reproduce the match without special gear. You should not do this to make private keys. This is only for research and learning.What you need
Step-by-step outline
What this means for users and for Bitcoin
NIST users: Keep calm and carry on
The new evidence points away from a hidden trap. Users of NIST P-256 and related curves do not need to switch libraries or update keys just because of this result. The seeds were always public, and the current proof only shows a likely path to how the NSA chose them. Anthropic also noted that while the source is now clear, some details—like why certain usable candidates were skipped—remain open.Bitcoin and Ethereum: little room to hide
Bitcoin does not use P-256. It uses secp256k1, which has far fewer adjustable dials. That leaves little space to hide a weakness. Ethereum adopted secp256k1 as well. Satoshi Nakamoto never said why he chose it, but the small number of choices has long been a point in its favor. The finding here does not change Bitcoin’s curve or its safety model.Quantum computing is a different threat
A strong quantum computer could work backward from a public key to a private key. That risk applies to many popular curves, no matter how their seeds were chosen. Google’s Willow chip showed better error rates in a key step, which is progress, but no one has a machine today that can crack a Bitcoin key. There is no firm date for when, or if, that will arrive. If you hold crypto, stick to normal safety steps:Open questions and what to watch next
For more news: Click Here
FAQ
Q: What did Anthropic’s Claude discover about the NIST curve seeds?
A: An Anthropic research model traced five unexplained NIST elliptic-curve seeds to outputs of the lrand48 random-number generator seeded with timestamps from 1997–1998. The model reproduced the P-256 published seed at the 1,842nd candidate in under 30 minutes, allowing others to rerun the same process.
Q: Why does this finding make a hidden NSA backdoor less likely?
A: The match to a predictable, ordinary RNG rather than a secret process suggests the seeds were produced by a reproducible method, which lowers the likelihood of a deliberate hidden backdoor. The seeds were public from the start and Anthropic said users of the NIST curves do not need to change anything.
Q: Does this discovery affect Bitcoin or its security?
A: No, Bitcoin uses the secp256k1 curve rather than P-256, and secp256k1 has far fewer adjustable parameters, leaving little room to hide a weakness. A separate, longer-term risk from sufficiently powerful quantum computers remains applicable to many curves but is not caused by this seed finding.
Q: What is lrand48 and why is its use significant here?
A: lrand48 is an older, predictable random-number generator found in C libraries that is fine for testing but unsuitable for creating secrets. Because the NIST seeds match lrand48 outputs seeded with timestamps, it explains the seed origin without exposing private keys, since the seeds were public.
Q: Do users of NIST P-256 need to change keys or libraries after this result?
A: Anthropic and the reporting say people using the NIST curves do not need to change anything because the seeds were public and the finding points away from a secret weakness. NIST curve users can continue using current keys while the community examines remaining questions.
Q: How can researchers reproduce the NIST P-256 seed origin explained result themselves?
A: To reproduce the NIST P-256 seed origin explained result, set a search window of plausible 1997–1998 timestamps, seed an lrand48 implementation, generate the output stream, and apply the same derivation and validity checks used to form candidate curve seeds. You should have a C, Python or Rust toolchain, an lrand48 implementation, NIST’s public curve parameters, hashing and big-integer support, and document environment details for others to match your run.
Q: What unanswered questions remain after Claude’s find?
A: Key open questions include why the process skipped some usable candidate seeds and how the remaining parts of each curve were selected beyond the seed step. The article says independent reproductions, published reference code and peer review are needed to close those gaps.
Q: What are the broader implications and next steps for the cryptography community?
A: The finding should increase trust because the seed path is now reproducible rather than mysterious, and the $36,864 bounty will go to the Internet Security Research Group. The community will likely focus on more public reproductions, shared reference code and peer reviews while continuing to monitor longer-term threats such as quantum computing.
* The information provided on this website is based solely on my personal experience, research and technical knowledge. This content should not be construed as investment advice or a recommendation. Any investment decision must be made on the basis of your own independent judgement.
Contents
