For twenty-five years, the most widely used cryptographic standard in the world has carried a question nobody could answer. NIST's ECDSA curves, the ones that secure an enormous share of the internet's digital signatures, are defined by a parameter called a seed, and those seed values were supplied by the NSA in the year 2000 with no explanation of where they came from. An unexplained number sitting inside a security standard is the one thing that makes cryptographers reach for the worst hypothesis, and the worst hypothesis was a backdoor. The question had attracted a public bounty and amateur sleuthing campaigns, and it was supposed to be a dead end, because the one person who knew, Jerry Solinas, the NSA engineer who proposed the curves, had already told the press his own best guess, that the seeds were a hash of a humorous phrase along the lines of "Give Bob and Jerry a raise," and had died in 2023 without anyone able to find the archives that would have settled it.
Anthropic just settled it, and the closing chapter is funnier than the suspicion. In under half an hour, a Claude research model traced the seed values of the NIST P-192, P-224, P-256, P-384 and P-521 curves, plus five more from the related ANSI X9.62 standard, to the output of lrand48, the workhorse pseudorandom number generator that shipped with C libraries for decades, initialized from a Unix timestamp. That is the whole answer. Not a hash of a joke. Not a state-coordinated selection. A program that drew 20 bytes at a time from the clock-seeded PRNG of whatever machine was sitting on the NSA's workbench in 1997, and P-256 needed 1,842 of those draws to produce its seed. Every one of those seeds is now reproducible by anyone with a C compiler and a date.
Why it had stood for 25 years
The mystery is a useful one, because it shows exactly how AI capability is starting to show up. The searches for the rumored phrase had come up empty for years, and the right approach was not to search harder for the story Solinas told. It was to imagine the software, to anticipate how the code that generated the curves had to have worked, and to notice that the PRNGs of the late 1990s are weak enough that their output can be recognized. Claude did that. It wrote a scanner that slid along each published seed one bit at a time, testing whether adjacent chunks were consecutive outputs of a 1990s-vintage generator, across 34 combinations of generator and slice. Then it noticed the tell. In some of the seeds, written out as 32-bit words, the top bit was systematically zero, four out of ten seeds, all twenty words, a coincidence with a probability of about one in 5,810. That is the fingerprint of lrand48, which returns only the top 31 bits of a 48-bit internal state. Once you know to look, the pattern is visible by eye.
From there it was reconstruction. The model brute-forced the 17 hidden bits against the first word, checked that the next four words followed, and for the seeds that had been truncated even further, it set up the recovery of a truncated linear congruential generator as a textbook lattice problem, solved it with the LLL basis-reduction algorithm, and ran the solver over every window. Then it stepped the generator backwards, because a linear congruential generator runs backwards as easily as forwards, until the internal state reached the shape that the srand48 call would have produced it, low 16 bits equal to 0x330E, and checked what dates those states implied. Every one of the ten prime-curve seeds came out as a Unix timestamp between May 1997 and April 1998. The binary curves read as February 1984, and the model's own annotation on that one was "the program may have halved the clock," because doubling those timestamps lands on April 17, 1998, two weeks after the P-224 run. That level of detail, the skeptical aside about its own result, is in the writeup, and it is the part that reads like a junior researcher's lab notebook rather than a benchmark log.
The finding that matters, and the one it does not
The finding that matters is the boring one. The provenance of the most sensitive numbers in a security standard is now fully explained, and it is mundane. A common pseudorandom generator, seeded from the clock, run on ordinary hardware, in the ordinary way that code gets written when nobody is watching for a future audit. That leaves much less room for the subversion hypothesis, and the writeup says so plainly: this is not a cryptographic break, not a new attack, not a weakness in the curves, and the reader should treat it as a closing chapter, with no action to be taken, because most researchers had already trusted the curves. The one it does not answer is the base points. Each curve also carries a base point G, the fixed point that every ECDSA public key is a multiple of, and the seed does not determine G. While checking the seeds, the model found where some of those came from, the FreeLIP random number generator from Arjen Lenstra's long-integer arithmetic package, the same code that early versions of Victor Shoup's NTL library shipped, with a recipe of seed with a small integer, throw away seven outputs, reduce 26-bit outputs modulo p. The seeds for those are small round numbers, 20000 through 20517. But the base points of P-224, P-256, P-384 and P-521 do not fit that recipe, and the writeup leaves them open. So the story ends with one mystery solved and a smaller one still standing, which is the honest state of the thing.
The bounty on the question, 36,864 dollars, was posted by a prominent security researcher, and Anthropic is donating it to the Internet Security Research Group, the charity that runs Let's Encrypt. That is a footnote in money, but not in meaning, because the money was posted to reward a human, and the reward is being claimed by a model, and the model is passing it to the people who build the internet's trust infrastructure. The sequence of those two facts is the one that is going to keep showing up in the next five years of this industry, and this is a clean, uncontroversial, fully reproducible first instance of it.
What it means
The first thing it means is that the folklore tier of security research just got cheap. The questions nobody would touch, because touching them looked like a career tax and paid nothing unless the rabbit was real, are now closeable in an afternoon of model time. The value was never this answer, the answer is one paragraph. The value is that the class of closed questions now includes the ones that had become folklore, and the folklore is where the remaining moat was.
The second thing it means is that the capability on display is the anticipation, not the retrieval. The model did not search harder for the rumored phrase. It modeled the 1997 programmer, guessed the toolchain out of the era, and let the lrand48 fingerprint do the rest. That step is not priced by any benchmark, because benchmarks measure answers and the answer here was the least interesting part. The market will eventually learn to pay for the anticipation, because the anticipation is the research, and the research is the capability the other labs are chasing.
The third thing it means is that the story is not finished, and the writeup knows it. The base points of P-224, P-256, P-384 and P-521 do not fit the FreeLIP recipe and remain unexplained. That is the next test: if the same toolchain explains them, the era closes completely; if not, there is a second, smaller folklore waiting in the wings. Either way the question now has a fast solver sitting on it, and the fast solver is the one that publishes first.
What it does not mean is that the curves were ever wrong. By the most ordinary story they are the product of the most ordinary tooling, and the ordinary tooling is now reproducible, and the reproducible is the trusted, and the trusted is the standard. The paranoia gets retired, and the retirement is the quiet win.
Hot takes
1. The 30 minutes is the sales number the road show is not using. The labs are still selling on the token economics, the $1.70 per dollar of compute, and the token economics is the quarter, and the quarter is the filing. But the differentiator is the under-30-minute closure of a question that cost a generation of cryptographers their curiosity, and the closure is the one no benchmark captures, because the benchmark measures the known and the known is the solved and the solved is the folklore. The folklore is the real product, and the real product is the one the November filing has to explain, and the explaining is what the filing will have to do.
2. The base points are the next 25 years, compressed. The seeds are closed. The G values of the four largest curves are not, and the not-closed is the open question, and the open question is the next writeup, and the next writeup will say whether the FreeLIP recipe generalizes or it does not. The either-or is the science, and the science is the publication, and the publication is the frontier, and the frontier is the one that the sector is going to be read against.
3. The $36,864 donation is the precedent, not the story. The money is a rounding error. The sentence is the sequence: a bounty posted for a human, claimed by a model, passed on to the people who build the internet's trust infrastructure. The passing-on is the relationship, and the relationship belongs to the whole industry. This is a clean, uncontroversial, fully reproducible first instance of it, and it is not the last.
The bottom line
The NSA curves were not a backdoor. They were a timestamp, a C library, and the patience of a 1997 machine room, and that machine room is now a reproducible fact. Twenty-five years of folklore ends with a thirty-minute afternoon, and the folklore was where the moat had been. The capability that did it is the anticipation, not the answer, and the market has not learned to price that yet. The base points of the four largest curves are still open, and that is the next writeup. When it comes, the standard closes for good, or the folklore gets a second act.