For a quarter of a century, an uncomfortable question has hovered over much of the cryptographic infrastructure that protects the internet: why did the NSA never explain how it generated the initial values for several elliptic curves standardized by NIST in the year 2000? That opacity has just been broken, and not thanks to a team of cryptographers working for months, but to an artificial intelligence model that took less than 30 minutes to find the answer.
The protagonist is Claude, the AI system developed by Anthropic. As the company itself has explained, the model managed to reconstruct the origin of the so-called cryptographic seeds that served as the basis for generating the parameters of the ECDSA standard, the most widely used digital signature scheme based on elliptic curves today.
Why this finding matters now
The issue is not an academic curiosity. ECDSA underpins the security of communications, transactions, and authentication systems worldwide. The fact that its mathematical foundations included values without documented justification from an intelligence agency like the NSA was reason enough for security experts to spend years trying, unsuccessfully, to rule out the possibility that they hid a backdoor.
The lack of explanation had even generated a financial reward for anyone who could solve the enigma, in addition to numerous failed attempts by researchers and enthusiasts who tested different hypotheses without being able to reproduce the original values.
The clue that wasn’t: the Jerry Solinas hypothesis
Until now, the most cited explanation came from Jerry Solinas, a deceased NSA employee, who had suggested that the seeds were obtained by applying a hash function to a humorous phrase. This hypothesis, which for years served as a reference for those trying to decipher the origin of the parameters, has turned out to be incorrect.
The data is relevant because it eliminates the only named lead that was circulating on the matter. Those who based their research on that idea were, in reality, following a dead end.
How Claude found the real answer
According to Anthropic, the origin of the seeds lies in lrand48, a simple pseudo-random number generator native to the C programming language. This generator had been initialized with a Unix timestamp between May 1997 and April 1998.
The key that allowed Claude to identify the pattern was a technical peculiarity of lrand48: this generator produces only 31 bits of output. When analyzing the seeds, the model detected that, in several of them, the highest bits were systematically zero, a trait that did not fit a truly random value and that pointed directly to the limitations of that specific generator.
From there, Claude was able to reconstruct the process: a deterministic function combined with a specific date was capable of reproducing the original seeds. This shows that these were not values chosen arbitrarily by hand, but the result of a reproducible and, by all indications, quite unsophisticated procedure.
Does this rule out a backdoor?
Anthropic maintains that this finding makes the existence of a deliberate backdoor in the affected curves less likely. It should be noted that this is a conclusion of the company itself, not an independent verification by the cryptographic community as a whole.
The underlying reasoning is that a simple and reproducible origin using a basic generator and a specific date points more to a careless procedure than to a design intended to introduce a hidden weakness. Explaining the origin of the seeds does not in itself prove that the curves are completely secure, but it does eliminate the opacity that fueled suspicion for 25 years.
The fate of the reward: $36,864 for internet security
Anthropic has announced that it will donate the $36,864 associated with the reward for solving the enigma to the Internet Security Research Group, an organization recognized for its work on digital security projects. The company has thus chosen to waive the financial prize linked to the discovery.
What it means for those who use elliptic curve cryptography
For those who work with systems that rely on ECDSA or NIST-standardized curves, the episode leaves several practical points. The origin of the seeds now has a documented explanation: they come from the lrand48 generator and a timestamp between May 1997 and April 1998, with the corresponding attribution to Anthropic.
The Solinas humorous phrase hypothesis is ruled out as a valid explanation, so it should not be used in technical or audit documentation. And it is worth remembering that the conclusion regarding the absence of backdoors belongs to Anthropic, so any organization that requires external validation should contrast it with independent reviews.
A precedent for reviewing old mysteries with new tools
Beyond the specific case, the episode leaves a lesson on how artificial intelligence tools can be applied to problems that had gone unsolved for decades, not through computational brute force, but by identifying patterns in data that, in theory, had been in plain sight for 25 years.
The case of the NSA seeds demonstrates that old, unexplained parameters can be re-examined with new tools, capable of finding in minutes what generations of researchers failed to clarify in a quarter of a century.
Frequently Asked Questions
What are the NSA cryptographic seeds that Claude solved?
They are the starting values that the NSA used to generate the parameters of several elliptic curves standardized by NIST in the year 2000, within the ECDSA standard, without the agency documenting at the time how they had been obtained.
Why was it concerning that those seeds were not explained?
Because if the initial values of a cryptographic system cannot be justified, it cannot be ruled out that they were chosen deliberately to introduce a hidden weakness or backdoor.
What was Jerry Solinas’s explanation and why was it discarded?
Solinas, a deceased NSA employee, had suggested that the seeds arose from applying a hash function to a humorous phrase. This hypothesis has turned out to be incorrect according to Claude's analysis.
How did Claude manage to find the real origin of the seeds?
It detected that the seeds came from the lrand48 random number generator, from the C language, initialized with a Unix timestamp between May 1997 and April 1998. The key was identifying that certain high bits were systematically zero, a trait characteristic of the limitations of that generator.
Does this prove there is no backdoor in the NIST elliptic curves?
Anthropic maintains that it makes that possibility less likely, but it is a conclusion of the company itself. Explaining the origin of the seeds eliminates the previous opacity, although it does not in itself constitute a total independent verification of the security of the curves.
What happened to the financial reward for solving the enigma?
Anthropic has decided to donate the $36,864 associated with the reward to the Internet Security Research Group, an organization dedicated to promoting internet security projects.
