Anthropic reports that Claude traced ten NIST and ANSI elliptic-curve seeds to lrand48, a 1990s C pseudorandom generator initialized from Unix timestamps. The published code reproduces the standardized 160-bit values, making the core mechanism unusually easy to check. The discovery closes a major technical gap, but it does not collapse three different claims into one: how the numbers can be regenerated, who generated them in 1997–1998, and why particular candidates were selected. AI-assisted science needs an attribution protocol that preserves those boundaries.
What Claude actually found
The Anthropic report starts with an old provenance problem. FIPS 186-2 published recommended elliptic curves and 160-bit seed values, including the P-256 seed C49D...7E90, without documenting where those seeds came from. Because curve generation can involve discretionary choices, the missing provenance sustained speculation about hidden selection criteria.
According to Anthropic, an internal research model abandoned the popular passphrase-hash hypothesis and looked for signatures of period-appropriate pseudorandom generators. It noticed cleared high bits consistent with lrand48, recovered hidden state, stepped the linear generator backward, and found states matching srand48 initialization. The resulting seeds corresponded to Unix timestamps between May 1997 and April 1998.
For P-256, the recipe is concrete:
- initialize
lrand48with timestamp 1997-08-16 01:52:34 UTC; - generate 20-byte candidates;
- take candidate 1,842;
- obtain the exact published seed
C49D360886E704936A6678E1139D26B7819F7E90.
I reran the compact reproduction code from Anthropic's page locally and obtained an exact P-256 match. That verifies the computational identity of this recipe. It does not by itself identify the original operator or recover the original program.
A five-level evidence stack
The cleanest way to report this result is to split it into claims that can fail independently.
| Level | Claim | Current evidence |
|---|---|---|
| 1. Published artifact | The standardized seed has a specific 160-bit value | NIST FIPS 186-2 and ANSI/NIST curve specifications |
| 2. Reproducible mechanism | A timestamp-seeded lrand48 stream regenerates the value |
Public code and exact output match |
| 3. Pattern across curves | Ten prime-curve seeds share the same generation pattern | Recovered states and matching timestamps reported by Anthropic |
| 4. Historical attribution | This was the process used by the original curve-generation team | Strong circumstantial fit, but no original source code, log, or contemporaneous signed record |
| 5. Intent and security meaning | The choices were benign and contained no deliberate selection | Reduced suspicion, not direct proof of intent |
Levels one and two are independently checkable today. Level three is also computational in principle, though an external review should rerun the entire ten-seed analysis and inspect the recovery tooling. Level four is a historical inference. Level five combines cryptographic analysis with a claim about human intent.
This separation matters because headlines naturally assign the whole result to the most visible actor: Claude. The actual research system included decades of public standards, earlier cryptographers who framed the provenance question, a bounty and amateur investigations, Anthropic staff who chose the question, the model's search and coding, and human validation and publication.
Why an exact 160-bit match is strong evidence
The central result is stronger than a vague resemblance. A candidate procedure regenerates a full published seed exactly. Anthropic reports the same pattern for five NIST prime curves and five ANSI X9.62 example curves, with recovered internal states that lead back to plausible timestamps.
Exact regeneration sharply narrows accidental coincidence. It also explains several visible properties of the seeds, such as bit patterns produced by truncating lrand48 output. Because the generator is linear and has only 48 bits of state, missing state bits can be searched or recovered using lattice techniques.
However, reproducibility answers a mechanism question: can this process produce these artifacts? Historical provenance asks a stronger question: did this exact program and operational workflow produce the archived standard values? The strongest missing evidence would be the original source tree, build artifact, execution log, disk image, or contemporaneous statement that records the procedure.
In other words, exact output is high-grade computational evidence and incomplete archival evidence.
The finding is not a cryptographic break
Anthropic explicitly says the result is not an attack or weakness in ECDSA. The weak PRNG reconstructed here generated public curve-selection seeds decades ago; it is not the per-signature secret nonce whose predictability would expose private keys.
The work does reduce one class of concern. A simple, reproducible timestamp process leaves less room for unexplained manipulation than an opaque seed with no plausible generation path. But the report also preserves open questions:
- B-163 remains unexplained.
- The base points for P-224, P-256, P-384, and P-521 remain unexplained.
- Several apparently viable curve candidates were skipped.
- The data does not reveal how many generation runs were attempted.
- Timestamps could, in principle, have been searched to select a desired property.
Anthropic argues that deliberate weakening is implausible because only a small number of candidates were skipped and useful weakened curves would need to be common enough to find. That is a security assessment, not a recovered statement of intent.
The operational conclusion is appropriately conservative: this publication does not require users to rotate ECDSA keys or abandon the curves. Standards decisions should continue to rest on current cryptanalysis and implementation guidance, not on a provenance story alone.
Base-point recovery shows why claims must remain granular
Claude also matched the base points of six curves to a generator in Arjen Lenstra's FreeLIP library. The published reproduction code starts from small integer seeds, discards seven outputs, constructs candidate x-coordinates, and matches the standardized points.
This is a separate result from seed recovery. The seed helps define a curve coefficient, while the base point G is another parameter. Some base points match the FreeLIP-derived recipe; several important NIST base points do not. Writing that Claude explained the origins of the NIST curves without this distinction would overstate the scope.
A robust report gives every claim its own identifier, evidence, and unresolved boundary:
- seed generation for ten prime curves: reproducible pattern;
- four binary curves: a plausible halved-clock interpretation;
- B-163: unresolved;
- six base points: reproducible FreeLIP pattern;
- other base points: unresolved;
- original operator and selection policy: historically unconfirmed.
Granularity prevents one impressive success from lending unearned certainty to adjacent claims.
A reporting protocol for AI-assisted discovery
The deeper contribution is a template for research workflows in which a model proposes and tests unusual hypotheses.
Preserve discovery and verification separately
Record the model configuration, prompt, tools, generated code, failed hypotheses, and timestamps. Then create a clean verifier that accepts only published inputs and produces deterministic outputs. A reasoning transcript can explain discovery, but the verifier must stand without it.
Assign work to the correct actors
State what the model proposed, what code it produced, what humans selected and checked, and what prior researchers supplied. Attribution is part of technical accuracy because it shows where independent failure could enter.
Distinguish computation from history
A deterministic match can reach a high evidence level without recovering human intent. Label archival gaps rather than filling them with a coherent story.
Require independent reruns
Publishing code makes reproduction possible. Independent reproduction exists only when another party actually runs the full analysis, verifies every curve, and checks the implementation against the standards.
Keep negative space in the abstract
Unexplained parameters, skipped candidates, unavailable archives, and absent external review belong near the conclusion, not in a footnote. They define the maximum strength of the claim.
This protocol is consistent with the site's earlier verification ladder for AI-assisted cryptographic discovery. The new case adds a useful twist: a result can be computationally decisive while remaining historically incomplete.
Frequently asked questions
Did Claude break ECDSA or the NIST curves?
No. The finding reconstructs a plausible generation process for public curve seeds and some base points. It does not provide a signature forgery or private-key attack.
Does timestamp-seeded lrand48 prove the curves contain no backdoor?
It makes arbitrary hidden selection less plausible and improves transparency. It does not prove the original designers' intent or exclude every possible selection strategy.
Can anyone reproduce the P-256 result?
Yes. Anthropic publishes short code that regenerates the P-256 seed from a timestamp and candidate index. The exact output can be compared with the standardized seed.
Why is historical attribution weaker than code reproduction?
The code proves that a process yields the artifact. Historical attribution additionally requires evidence that the original team used that process, such as contemporaneous source code, logs, archives, or testimony.
What remains unexplained?
The B-163 seed, several NIST base points, the criteria behind skipped viable candidates, and the number of attempted runs remain unresolved in Anthropic's report.