Where NIST's Elliptic Curve Seeds Came From

1 — Not that kind of seed

When cryptographers say "seed" here, they don't mean the twelve-word recovery phrase for a crypto wallet, and they don't mean a secret key. In the 2000 standard that defined NIST's elliptic curves (FIPS 186-2), a seed is a public number. Run it through a hash function and the output pins down the constants of the curve's equation. Anyone can repeat the steps and check that the published seed produces the published curve. Nothing about it is secret.

2 — Why standards publish "nothing up my sleeve" numbers

A curve needs constants, and whoever picks them could in principle choose ones with a weakness only they know about. The standard defence is to derive the constants from a seed through a hash, so the numbers look random and can't easily be steered. That only fully works if the seed itself has an innocent explanation. A seed that is just a pile of bits invites the obvious question: where did you get that? When the explanation is public, the number is called "nothing up my sleeve," because there is nothing hidden left to inspect.

3 — Twenty-five years of "where did these come from?"

The NSA supplied the seeds without explaining them. NSA mathematician Jerry Solinas passed them to the ANSI standards committee in fall 1997, and NIST adopted them in 2000. Whether he personally chose them has never been shown, and he died in early 2023 with the question still open. Suspicion had grown after the 2013 revelations about Dual_EC_DRBG, a different NSA-linked standard that NIST later dropped. A story that the seeds were hashes of a humorous phrase traced back to Solinas's own recollection, repeated by colleagues, and turned out to be wrong, according to Anthropic. In October 2023, cryptographer Filippo Valsorda put up a bounty of $12,288 for the five prime-curve seeds, which a winner could redirect to a US charity at triple the amount. He assumed the inputs were English phrases run through SHA-1.

4 — What was found

On October 16, 2026, Anthropic's Frontier Red Team reported that the seeds were never hashes of a phrase at all. For P-192, P-224, P-256, P-384 and P-521, they are output from a standard Unix random-number generator (Anthropic calls it lrand48, Valsorda calls it drand48; they produce the same bytes), started from a clock reading. The P-256 seed matches a run started at 01:52:34 UTC on August 16, 1997, at candidate number 1,842. That is August 15 in US local time, so always read it as UTC. The ten prime-curve seeds, five from NIST and five from a parallel ANSI standard, line up with timestamps between May 1997 and April 1998.

5 — How it was worked out, and how it was checked

According to Anthropic, an employee asked an internal research model to work out how the seeds were made, and Claude found the answer in under half an hour. It noticed that four of NIST's ten published seeds, all for binary curves, had a zero in the top bit of every 32-bit word, something that would happen by chance about once in 5,810 times. It brute-forced the 17 hidden bits for those four, and used a lattice-reduction technique to recover the generator's state for the ten prime-curve seeds (five NIST, five ANSI). Each recovered state regenerated all 160 bits of its seed, which does not happen by accident. Ten Anthropic researchers are credited, and the team published CC0-licensed Python code that reproduces all but one of the seeds. Valsorda reimplemented the method in Go and got the same five NIST prime-curve seeds. He ran the bounty, which an Anthropic author helped fund, so he is not a fully disinterested party, but he is an outside check.

6 — What it does and doesn't mean

Anthropic is explicit that this is not a cryptographic break, a new attack or a weakness in the curves, and says there is no action to be taken or things to do differently. Its argument is that a simple, public, reproducible generator makes a deliberately weakened curve much less plausible. "Much less plausible" is not "disproven." Knowing how a seed was generated doesn't tell us why the published candidate was picked, though it does shrink how much choice anyone had. Anthropic calls selection by searching over timestamps "still conceivable" in principle, then argues it is unlikely, since you would only do that to disclose the timestamp as evidence the seed was innocent. Valsorda estimates the room left for selection at about 30 bits, too little for the weakness-hunting technique Bernstein and Lange described, while some cryptographers still say any free choice is a weakness on principle. And no, this has nothing to do with Bitcoin, which uses a different curve, secp256k1.

7 — What's still unexplained

Several pieces remain open. One seed, B-163, fits nothing Claude has tried. The base points for P-224, P-256, P-384, P-521 and the NIST binary curves are unexplained. P-256 uses candidate 1,842, but candidate 876 also produced a valid curve, and nobody has found the rule that skipped it; Valsorda found one extra filter, and it doesn't explain 876. Hacker News readers raised the sharpest form of the objection: the discarded candidates are invisible, so a quiet search over timestamps can't be excluded. Others replied that the freedom left is only about 30 bits.

8 — How to read "AI solved X" headlines

Ask four questions. Who set the problem? Humans did: the mystery was 25 years old and Valsorda's bounty framed it. Who did what? Anthropic says Claude did the discovery work, with ten named Anthropic researchers credited, so crediting the team using Claude is more accurate than "AI alone." What was actually verified? Recovered states that regenerate the full seeds, public code that others can run, and an outside reimplementation. What is still open? The one unexplained seed, the base points and the selection question. A headline that can't answer all four isn't finished reporting.

The big picture

By Anthropic's account, all but one of the seeds that anchored NIST's curves for 25 years came from a standard Unix random-number generator started from clock readings in 1997 and 1998: mundane, dated and reproducible. That makes a hidden backdoor harder to believe without proving one never existed, because how a number was generated is not the same as how it was chosen. The more durable lesson is how to hold a claim like this one: check who did what, what was verified, what anyone can reproduce, and what is still open.

In your own words: why does the P-256 seed, candidate 1,842 of a random-number generator run started at 01:52:34 UTC on August 16, 1997, make a backdoor less plausible but not impossible, and what is one thing about the curves that is still unexplained?

You just read about it. Could you teach it?

Reading a good explanation feels like understanding it. Usually it isn't the same thing — and you don't find out which one you've got until someone asks you to explain it back.