Claude NSA Curve Discovery Solves a 25-Year Mystery, but Not Every Question

Claude traced five unexplained NSA-supplied numbers to a 1990s random generator, resolving a cryptographic mystery that had lasted roughly 25 years. The Claude NSA curve discovery does not expose broken encryption or a new attack. Instead, it reconstructs how important parameters were probably produced.

Anthropic says an internal research model reached the result in under 30 minutes. The model connected published NIST curve seeds to lrand48, a predictable generator included with older C software libraries. It then recovered timestamps corresponding to dates between May 1997 and April 1998.

That result weakens one longstanding suspicion. Cryptographers had questioned whether the NSA searched through many possible curves until it found secretly vulnerable ones. However, the discovery does not reconstruct every design decision, and Anthropic remains an interested party evaluating its own model.

The Claude NSA Curve Discovery Reconstructed Five Seeds

Claude found a reproducible path from historical timestamps to five standardized NIST curve seeds.

Anthropic published the result on October 16, 2026, in a detailed curve-origin report. The company said an employee gave its internal research model the open problem without emphasizing the leading theory.

That theory involved a forgotten humorous phrase. NSA mathematician Jerry Solinas had once recalled that a seed might have come from words resembling “Give Bob and Jerry a raise.” Previous investigators spent years testing possible phrases and hashing methods without finding the published values.

Claude approached the problem as a software-forensics exercise. It considered what tools a programmer creating curves during the late 1990s would probably have used. That shifted the search from human language toward common software libraries.

The model tested 34 combinations of older generators and different slices of their output. It noticed that the highest bit was consistently clear in portions of several seeds. Anthropic calculated that this visible pattern would occur randomly with a probability of one in 5,810.

That clue pointed toward lrand48, a linear congruential generator with a 48-bit internal state. A linear congruential generator creates a repeatable number sequence by applying the same arithmetic operation after every output.

The model then worked backward from the published values. For one group, it tried all 131,072 possible settings for 17 hidden bits. Consecutive outputs matched the expected sequence.

The prime-curve seeds required another step because each generator output had been truncated. Claude used lattice reduction, a mathematical technique for recovering structure from partial numerical information.

Anthropic says five NIST prime-curve seeds and five ANSI X9.62 example seeds shared the same pattern. Each recovered state regenerated the complete 160-bit seed, providing a much stronger match than a superficial resemblance.

Claude also stepped each sequence backward to a state consistent with srand48, the function used to initialize the generator. Every recovered initialization corresponded to a plausible Unix timestamp between May 1997 and April 1998.

The P-256 sequence began at a timestamp corresponding to August 16, 1997. The generator reached the standardized seed after 1,842 candidates. Anthropic published short reproduction code so independent researchers can generate the same value.

This reproducibility separates the result from a loose historical guess. The public code maps specific dates, generators, and iteration counts to the exact published seeds.

Still, it does not provide documentary proof of what happened inside the NSA. No recovered source code, development notes, or agency records confirm that the original designers followed this exact procedure.

The evidence is computational rather than archival. It shows that a simple and historically plausible process produces the numbers exactly. That makes coincidence extremely difficult to sustain as an alternative explanation.

Why Unexplained NIST Curve Seeds Created Suspicion

The concern was never that the seeds were secret, but that their unexplained selection left room for hidden influence.

Elliptic-curve cryptography uses mathematical curves to support signatures, key exchange, and other security operations. Its safety depends partly on difficult mathematical problems and partly on trustworthy public parameters.

NIST adopted a collection of NSA-supplied curves in 2000 through FIPS 186-2, its Digital Signature Standard. The specification published seed values but did not explain where those values originated.

A seed helps derive part of a curve’s public equation. Publishing it can support a “nothing up my sleeve” argument, meaning designers did not freely manipulate every parameter.

That assurance depends on knowing how the seed itself was chosen. Without a documented process, observers cannot rule out repeated trials designed to reach a preferred curve.

Cryptographers Neal Koblitz and Alfred Menezes examined this problem in their 2015 enigma paper. Their analysis placed the curve controversy within a wider debate over transparency, trust, and government-designed standards.

Suspicion increased after disclosures about Dual EC DRBG, a different NSA-associated random-number generator. Researchers had warned that its unexplained constants could support a backdoor under specific conditions.

NIST ultimately withdrew its recommendation for Dual EC and published revised Dual EC guidance. That episode did not prove that the standardized elliptic curves contained similar weaknesses.

It did show why unexplained parameters deserved scrutiny. A government agency possessing exceptional cryptanalytic expertise also had intelligence missions that encouraged access to protected communications.

The missing origin story therefore carried institutional weight. Users had to trust curves supplied by an agency that would benefit from knowing weaknesses unavailable to everyone else.

The NIST curve seeds were public from the beginning. They were not passwords, signing keys, or wallet secrets. Their importance came from the design history they might reveal.

A malicious designer could theoretically test many candidate seeds, reject ordinary curves, and publish one with a subtle exploitable property. Outsiders would see a formally valid seed without knowing how many alternatives were discarded.

This is the commitment-versus-transparency conflict at the center of the story. The standards process presented fixed numbers, but it did not preserve a convincing public account of their selection.

Steve Weis and other researchers pursued that missing account through historical investigation and public-records requests. NIST reportedly had no surviving documentation that resolved the question, while responses from the NSA did not produce an answer.

In 2023, cryptography engineer Filippo Valsorda and contributors created a seed bounty for a reproducible explanation. The award could reach $36,864 if donated to charity.

Jerry Solinas died that year. His death removed the person most closely connected to the numbers, increasing the chance that the original process would remain undocumented permanently.

Claude’s result changes that situation because the numbers now supply their own historical evidence. They encode recognizable properties of an old generator and lead backward to plausible development dates.

That does not erase the standards process failure. A trusted cryptographic design should not need decades of reverse engineering to establish where its public parameters came from.

How Claude Worked Outside the Old Assumption

The important AI contribution was not raw computation alone, but a change in the search model.

Human investigators had inherited a memorable clue from Solinas. They expected a phrase, a hash function, or a combination of both. That clue narrowed the search while also anchoring it to an incorrect story.

Anthropic says its employee deliberately avoided steering Claude toward the phrase theory. The model instead asked what software behavior might leave visible traces inside the seeds.

This was a productive reframing. Old pseudorandom generators were common, deterministic, and weak enough for portions of their internal structure to remain detectable.

Claude reportedly wrote code to slide through the seed bits and compare adjacent chunks against generator outputs. This combined hypothesis generation, program creation, mathematical analysis, and verification.

It also used established techniques rather than inventing new cryptographic mathematics. Brute force recovered a small hidden state in one case. Lattice reduction handled truncated output in another.

The Claude cryptography discovery therefore resembles an accelerated research workflow. The model proposed a plausible mechanism, built tests, rejected alternatives, and checked exact outputs.

Humans still played essential roles. An Anthropic employee selected the problem, supplied context, ran the research environment, and recognized the importance of the result.

The company’s listed team included John Wood, Henry de Valence, Ava Howell, Zack Voase, Lucy Sweet, Amir Omidi, Paul Crowley, Iain McGinniss, Nicholas Carlini, and Steve Weis.

The result also depended on decades of prior work. Researchers had documented the unexplained parameters, preserved historical testimony, organized the bounty, and clarified what a valid solution required.

Claude did not independently discover that an important mystery existed. It entered a carefully described problem with published standards, known target values, historical clues, and an objective computational test.

Even so, the speed matters. Researchers knew the target for years, yet the alternate generator hypothesis apparently had not produced the complete reconstruction.

Anthropic quoted the model questioning whether it was operating inside a simulation after finding the match. It then checked the odds and exact bit patterns before accepting that the result was real.

That response is interesting, but the internal monologue is not the strongest evidence. The reproducible mapping from generator states to published values carries the technical case.

Readers should also separate this result from claims that AI autonomously solved advanced mathematics. Claude applied known tools to a bounded forensic problem whose answer could be checked mechanically.

That limitation does not make the achievement trivial. Scientific work often advances when someone selects the right abstraction and tests it efficiently.

The discovery suggests that research models can search neglected combinations of ordinary techniques. Such systems may become especially useful where archives, code, standards, and mathematics overlap.

They can also inherit false assumptions from prompts. Had the employee emphasized the humorous phrase, Claude might have repeated the same unproductive search path.

The lesson for research teams is operational. Models perform better when they can generate competing hypotheses, write verification code, and encounter falsifiable targets.

A research result should also leave behind more than an impressive transcript. It needs reproducible code, specified inputs, a documented environment, and clear boundaries around unresolved questions.

The Result Eases Backdoor Fears Without Proving Perfect Design

The reconstruction makes deliberate seed manipulation less plausible, but it does not certify every NIST curve decision.

Anthropic explicitly says the finding is not a cryptographic break, new attack, or newly identified weakness. Users do not need to replace keys because of this discovery.

The weak lrand48 generator would be unsafe for producing a private cryptographic key. Anyone who estimated its initialization time might reconstruct its output.

That is not what happened here. The NSA-supplied seeds were public inputs used to derive public curve parameters. Their predictability now helps explain their provenance.

The distinction is crucial. A weak generator can be dangerous when secrecy depends on unpredictable output. It can support transparency when researchers need to reconstruct a public design process.

Anthropic argues that the timestamp-based sequence leaves less room for targeted subversion. The recovered process looks like routine generation rather than an opaque selection from unlimited hidden alternatives.

However, the reconstruction contains several gaps. Claude did not recover the B-163 binary seed, despite matching four other NIST binary-curve seeds.

It also did not explain the base points for P-224, P-256, P-384, or P-521. A base point is the fixed public point multiplied when generating elliptic-curve keys and signatures.

Claude did trace six other base points to a generator from the FreeLIP long-integer library. Those included P-192 and five ANSI example curves generated in May 1997.

The model found small integer initialization values for those base points. It also reconstructed a process that discarded seven outputs before generating candidate coordinates.

Yet the most widely discussed curves retain unanswered base-point histories. That means the phrase “mystery solved” applies most strongly to the seeds, not every parameter.

Candidate selection presents another uncertainty. P-256 used candidate 1,842, but candidate 876 also produced a prime-order curve with the expected size and construction.

Anthropic identified additional viable candidates skipped during the P-224 and ANSI runs. The company does not know whether selection criteria, implementation behavior, or another reason explains those omissions.

It considers targeted weakening implausible because relatively few viable candidates were skipped. A practical search for a rare secret weakness would normally require much broader selection freedom.

That reasoning is credible but not absolute. The numerical reconstruction cannot reveal how many full runs occurred before the published sequence.

It also cannot establish the designers’ intentions. Matching timestamps and generator states shows how the values can be reproduced, not why every final choice was made.

This is where independent review matters. Anthropic developed Claude, conducted the experiment, interpreted the result, and published the technical narrative.

Its reproduction code allows outsiders to check the exact seed matches. Independent cryptographers must still examine assumptions surrounding truncation, timestamp interpretation, candidate criteria, and historical plausibility.

The Claude NSA curve discovery is therefore stronger than a company benchmark. It produces a falsifiable technical artifact rather than a score on an evaluation designed by the vendor.

Still, the safest conclusion remains narrower than the headline. Claude found compelling, reproducible origins for most targeted seeds and several base points.

It did not prove that no hidden property exists in every standardized curve. It also did not retroactively make the original documentation process adequate.

The discovery reduces one important category of suspicion. It cannot convert missing historical records into a complete audit trail.

Bitcoin Is Not the Curve at the Center of This Story

Bitcoin uses a different elliptic curve, so Claude’s finding neither repairs nor compromises Bitcoin wallets.

Bitcoin signatures rely on secp256k1, while the central reconstructed NIST seed belongs to P-256 and related standardized curves. These names describe different parameter sets.

Secp256k1 uses conspicuously simple constants. Its design leaves fewer adjustable values than curves whose coefficients derive from unexplained seeds.

That simplicity has long supported confidence that its designers did not search a large hidden space for a secret weakness. It does not provide universal protection against implementation bugs or future algorithms.

Ethereum also uses secp256k1 for account signatures. Bitcoin retained the curve when its Taproot upgrade introduced Schnorr signatures in 2021.

CoinDesk’s reported implications correctly separate the NIST seed question from Bitcoin’s security model. The common thread is elliptic-curve cryptography, not the same curve.

Claude did not crack an elliptic-curve private key. It reconstructed public seed-generation history from public numbers.

No wallet balance became accessible because lrand48 appeared in the historical process. The standardized seed was never supposed to remain secret.

A wallet developer using lrand48 for private keys would create a severe vulnerability. That separate scenario should not be confused with generating public design parameters.

The discovery also says nothing decisive about quantum computing. A sufficiently capable fault-tolerant quantum computer could threaten elliptic-curve signatures through Shor’s algorithm.

That attack would target the mathematical relationship between public and private keys. It would not depend on how a curve’s original seed was selected.

No publicly demonstrated quantum computer can currently recover operational Bitcoin keys at the required scale. Timelines remain uncertain because hardware must improve in size, reliability, and error correction.

The immediate impact falls instead on trust in standardized curves. Organizations using P-256 can view the reconstructed seed process as additional historical assurance.

They should not treat the result as a reason to halt post-quantum planning. Migration toward quantum-resistant standards addresses a different threat and a different timeline.

The story also offers a warning for technology reporting. Familiar names such as NSA, cryptography, and Bitcoin can make a parameter-history investigation sound like an active breach.

The actual event is subtler. An AI system resolved part of an old provenance problem, and that resolution modestly strengthens confidence in existing designs.

Nothing was decrypted. No blockchain was compromised. No secret government key was exposed.

That narrower result matters because secure standards depend on more than mathematical difficulty. They also depend on processes that outsiders can inspect and reproduce.

When documentation fails, even sound parameters accumulate suspicion. Claude helped recover evidence that the standards process should have preserved from the start.

Three Signals Will Show Whether This Becomes a Research Model

The next test is whether independent experts validate the method and whether similar AI-assisted discoveries survive outside Anthropic.

The first signal is independent technical replication. Cryptographers should rerun the published code, examine the recovered states, and test whether another plausible process explains the same values.

Exact reproduction would strengthen the core finding. Discovery of hidden assumptions or ambiguous alternatives would narrow Anthropic’s conclusion.

The second signal is progress on the unresolved parameters. B-163 remains unexplained, along with several NIST base points and the criteria behind skipped candidate curves.

A follow-up reconstruction would show that the method extends beyond the easiest visible pattern. Continued failure would define a clearer boundary around Claude’s contribution.

The third signal is repeated performance on unrelated research problems. One striking result cannot establish that AI systems reliably conduct independent mathematical or security research.

Future cases should include expert-defined verification standards, complete computational records, and external review. The most persuasive work will produce artifacts that specialists can challenge without trusting the model vendor.

Anthropic’s result also raises a practical question for standards organizations. Public parameters should come with transparent generation procedures, source code, test vectors, and preserved design records.

Those requirements reduce dependence on institutional reputation. They also prevent later researchers from spending years reconstructing decisions that should have been documented.

The $36,864 bounty will be donated to the Internet Security Research Group, according to Anthropic. That nonprofit operates Let’s Encrypt, which provides widely used website certificates.

The award gives the discovery a concrete ending, but the larger significance lies elsewhere. AI found value in a neglected intersection of old software, historical testimony, and cryptographic mathematics.

This is a useful pattern for developers and research teams. Models can search across code, standards, and archived reasoning, while humans define evidence thresholds and inspect conclusions.

Teams should preserve the generated hypotheses, failed paths, scripts, and verification outputs. A polished answer alone cannot distinguish discovery from a confident coincidence.

The Claude cryptography discovery deserves attention because outsiders can test its central claim. That is a higher standard than accepting a benchmark score or dramatic model transcript.

The next one to three months should bring replications, critiques, and attempts to explain the remaining parameters. Those responses will determine how broadly the achievement should be interpreted.

For now, the Claude NSA curve discovery closes much of a famous seed mystery without closing every cryptographic question. Follow the independent reviews, inspect the reproduction code, and watch whether the unresolved values yield to the same approach.