‘Wow, it’s a real discovery’: Claude cracks a 25-year NSA number mystery

What it claims

An internal Anthropic research model traced five NIST elliptic-curve seeds, supplied by the NSA in 1997, to lrand48, a random-number generator found in older C libraries, seeded with timestamps from 1997 and 1998. Per Anthropic's blog, as reported, users of the NIST curves do not need to change anything. Because anyone can now rerun the generator and reproduce the published seeds, a deliberately searched-for weak curve is much less likely. The finding does not fully clear the curves (see Limits).

How it works

• An Anthropic employee asked the model to investigate. They did not share the leading prior theory, which was that the seeds came from a humorous phrase NSA mathematician Jerry Solinas had forgotten. That theory had sent earlier investigators searching through word combinations.
• The model regenerated lrand48 output sequences from candidate timestamps and compared them to the published seeds.
• For P-256, the published seed matched exactly at the 1,842nd candidate.
• The whole search took under 30 minutes.

Evidence

• Reproducibility. An exact seed match was found for P-256, and five curve seeds were traced in total. Anyone can rerun the program to check.
• Chance of a false match. In its reasoning trace, the model noted that all 20 top bits of the matched output were clear, which it put at roughly a 1-in-a-million chance. It used this to conclude the match was real and not a simulated test.
• No prior explanation existed. Weis's 2018 public-records requests got no documentation from NIST and no further response from the NSA. The 2023 bounty from Valsorda and others went unclaimed: $12,288, rising to $36,864 if donated, and now going to ISRG.

Limits

• Open questions remain. The team cannot explain why the generator's output skipped over some usable candidates. It also cannot explain how the other parts of the curves were chosen. The seeds are now accounted for; the full curve design is not.
• Never use lrand48 for secret keys. The same predictability that made this reconstruction possible would be fatal for a secret. A key generated with lrand48 can be recreated by anyone who knows roughly when it was made. The NSA seeds were public from the start, so nothing secret was exposed here.
• secp256k1 (Bitcoin, Ethereum) was never in question. Its equation uses two small fixed constants. P-256 instead uses a 77-digit constant derived from the unexplained seed, which left more room to hide a weakness.
• Quantum risk is separate. A large enough quantum computer could recover private keys from public keys regardless of how the curve was chosen. The article cites Google reporting this week that its Willow chip cut errors about 40-fold in one costly step. No machine near that scale exists, and there is no clear timeline for one.
• Source quality. This is secondhand press coverage. The model is not named, and no code, candidate list or timestamp range is given. Check Anthropic's blog before relying on the details.