What happened
In October 2026 an Anthropic researcher asked Claude to investigate the provenance of the seed values that define the NIST elliptic‑curve digital‑signature standard (ECDSA). Within 30 minutes Claude built a scanner that matched the published 20‑byte seeds against output patterns of the lrand48 linear‑congruential generator. The model recovered the hidden 48‑bit state, traced it back to srand48 initializations, and showed that each seed corresponded to a Unix timestamp between May 1997 and April 1998. Claude also linked several base points to the random‑number generator used in the FreeLIP/NTL libraries. The work, authored by a team of Anthropic researchers, was posted publicly with source code released to the public domain.
Anthropic’s internal research model Claude was prompted in October 2026 to determine how the NIST ECDSA seed values were derived. The model hypothesized that the seeds came from a 1990s C library PRNG, specifically lrand48, which outputs the top 31 bits of a 48‑bit state.
Claude wrote a scanner that examined each 20‑byte seed in overlapping 20‑byte windows, testing 34 combinations of generator and output slice. The scanner identified a distinctive pattern—zero top bits in several words—that matched lrand48’s output format.
By brute‑forcing the hidden 17 bits of the first word and verifying subsequent words, Claude recovered the full 48‑bit state for each seed. For the prime‑curve seeds, it used the Lenstra–Lenstra–Lovász (LLL) lattice reduction to reconstruct the state from truncated bits.
Back‑tracking the state to its srand48 initialization revealed Unix timestamps ranging from May 1997 to April 1998 for the prime curves, and February 1984 (doubled to April 1998) for the binary curves. Claude also linked several base points to the random‑number generator in the FreeLIP/NTL libraries, providing the first public explanation for those points.
The team released the analysis, code, and a bounty donation of $36,864 to the Internet Security Research Group, and placed the code in the public domain under CC0.
Source details: anthropic.com ↗
Why it matters
The discovery settles a 25‑year debate about whether the NIST curve parameters were deliberately chosen to embed a cryptographic backdoor. By demonstrating that the seeds were produced by a simple, timestamp‑seeded PRNG, Claude’s analysis reduces suspicion of intentional subversion and strengthens confidence in the security of widely deployed ECDSA signatures. The result also showcases the ability of large language models to perform sophisticated reverse‑engineering tasks, including lattice‑based state recovery, without human‑provided clues. This has broader implications for how AI can aid cryptographic research, audit legacy standards, and uncover hidden assumptions in legacy code. However, the analysis did not explain all base‑point selections, and one binary‑curve seed remains unexplained, leaving a small residual uncertainty.
The analysis directly addresses long‑standing concerns raised by cryptographers such as Koblitz and Menezes about possible hidden weaknesses in NIST curves. By showing a transparent, reproducible generation process, the work reduces the perceived risk of intentional backdoors.
Claude’s ability to autonomously formulate a hypothesis, design a scanner, and solve a lattice‑based reconstruction problem demonstrates a new class of AI‑assisted research capabilities that go beyond natural‑language tasks.
The methodology could be repurposed to audit other standards where seed provenance is unclear, potentially uncovering hidden vulnerabilities before they are exploited.
The remaining unexplained binary seed and undisclosed base‑point generation for several curves highlight limits of the current approach and suggest areas for further investigation.
Interactive Mechanism: How It Actually Works
Explore the underlying technology behind this development interactively.
Which component of an AI application is the machine-learning model itself?
What to watch next
Future work may extend Claude’s methodology to other legacy cryptographic parameters, potentially revealing further undocumented generation processes. Watch for follow‑up publications from Anthropic or independent researchers that either confirm the remaining unexplained seeds or apply similar AI‑driven forensics to other standards. Additionally, monitor any policy discussions about AI‑assisted security audits, as regulators may consider formalizing AI‑based verification of cryptographic primitives. Finally, observe whether Anthropic releases tooling or APIs that let external analysts replicate Claude’s scanner on other datasets.
Anthropic may publish a reusable toolkit or API that allows external security researchers to apply Claude’s scanning technique to other cryptographic datasets.
Standard‑setting bodies (e.g., NIST) might reference the findings in future revisions of the Digital Signature Standard, possibly adding provenance requirements for new parameters.
Regulators could consider guidelines for AI‑driven security audits, especially as AI models become capable of low‑level code analysis and reverse engineering.
Independent cryptographers may attempt to replicate or extend the analysis to the still‑unexplained seeds, which could either close the remaining gaps or reveal new complexities.