For more than two decades, cryptographers have wondered where some of the most widely used numbers in security came from. The NIST elliptic curves P-192, P-224, P-256, P-384 and P-521, standardised in 2000 and used across the web for digital signatures, were each defined from a published seed whose origin was never explained. Because the seeds came from the NSA without a recipe, some suspected they might hide a weakness. Anthropic's Frontier Red Team says an internal Claude model has now worked out how they were made, and the answer is mundane.
The seeds were not hashes of a phrase, as rumour had it. They were raw output from lrand48, the random number generator in 1990s C libraries, started from a Unix timestamp. An Anthropic employee asked the model to find the origin without mentioning the earlier clue, and it got there in under 30 minutes. It wrote a scanner to test whether chunks of each seed looked like consecutive outputs of old generators, noticed that some seeds had their top bits set to zero far more often than chance allows, and then recovered the generator's hidden state for the prime-curve seeds using a standard lattice technique. Stepping the generator backwards, every starting point turned out to be a timestamp between May 1997 and April 1998. P-256's seed was candidate 1,842 in its run, and each recovered state regenerates all 160 bits of its seed, which rules out coincidence.
The finding adds to trust rather than eroding it. Anthropic stresses this is not a break or a new attack: a seed taken from a timestamped run of a weak generator leaves little room for someone to have hunted for a deliberately flawed curve. As a bonus, the model also explained the base points of P-192 and five related ANSI example curves, which came from the random generator in Arjen Lenstra's FreeLIP library; Anthropic believes no NIST base point had been explained before.
For readers, there is nothing to do. P-256 and its siblings were already widely trusted, and Anthropic says plainly that no action is needed. The interest lies in the method: a model reasoning about how 1990s software probably worked, rather than brute-forcing guesses, solved a puzzle that had beaten human efforts, including earlier attempts by Anthropic staff.
Some questions remain. A few viable candidates were skipped; for P-256, candidate 876 of the same run would also have produced a suitable curve, and the selection rule is unknown, though Anthropic argues the number skipped is too small to suggest deliberate weakening. One binary-curve seed, B-163, fits nothing tried, and the base points of P-224, P-256, P-384 and P-521 are still unexplained. The code to reproduce the work is public, so others can check it.