Claude Traces NIST Curve Seeds: What the ECDSA Discovery Means

Anthropic says an internal Claude research model reconstructed how several public elliptic-curve seeds were generated in the 1990s. Its October 16 report concerns parameters used by ECDSA, a digital-signature system.

The discovery does not recover private keys or break ECDSA. It requires no user action, and the report does not announce a publicly available model.

What was the mystery?

The original FIPS 186-2 standard, published in 2000, lists curves including P-192, P-224, P-256, P-384 and P-521. For these curves, it publishes a 160-bit seed alongside other parameters. A SHA-1-based procedure turns that seed into material used to define the curve. Publishing the seed lets others check that calculation.

That gives a useful distinction: someone can verify the transformation from a seed to a curve while still wanting to know why that particular seed was chosen. Reproducibility at one stage leaves the preceding choice unexplained.

These public parameters are shared by many users. Each user's private key is a separate secret number, and the corresponding public key is a curve point calculated from it. RFC 6979 describes that separation. Learning the historical input used to choose a shared curve supplies no user's private number.

How the seeds were reconstructed

According to Anthropic, Claude recognized evidence of the old C-library generator lrand48, recovered its internal state, and traced the prime-curve runs to Unix timestamps in 1997 and 1998. The generator produced successive 20-byte candidate seeds. P-256's published seed appears at candidate 1,842. Anthropic supplies code that reproduces the values, making the central result directly checkable.

Cryptographer Filippo Valsorda provides an important second source. In his independent account, he says he reimplemented the algorithm in Go to verify the claim and awarded the existing seed-recovery bounty. He concludes that the recovered generation process strengthens confidence in the curves. His verification code also gives readers a separate implementation to inspect.

Independent reproduction matters especially in an AI discovery story. A model's explanation can sound convincing without being correct. Here, the proposed process has to reproduce exact values published decades earlier. That creates a much firmer test than judging whether the explanation reads like expert work.

What remains unknown

The reconstruction leaves gaps. Anthropic reports that B-163's seed remains unexplained, along with the base-point origins for P-224, P-256, P-384 and P-521 and the NIST binary curves. It also says the recovered numbers cannot reveal how many generation runs occurred.

Valsorda identifies another limitation: some candidates meeting the reconstructed acceptance conditions were skipped. For P-256, candidate 876 also qualifies, before the published candidate 1,842. He discusses possible implementation explanations but does not establish one. The evidence supports a narrower claim about the generation process than a complete account of every historical decision.

Why this matters for AI engineering

My takeaway is that this is a useful example of AI-assisted investigation with an unusually clear verification target. The strongest part is the checkable result. The vendor's account of how quickly its internal model found it answers a different question, and cannot establish how reliably a public model would solve comparable research problems.

There is also a communication lesson. A weak generator used to select public parameters can sound alarming when described without context. Security requirements depend on which value is being generated and what must stay secret. RFC 6979 explicitly requires strong randomness for private-key generation, even when signatures use a deterministic procedure. That requirement remains unchanged.

I'm Paras. I work at the intersection of AI, engineering and distribution.

I help AI teams turn technical work into clear stories that explain what changed, what the evidence supports and why it matters.

Book a 30-minute call.