Claude AI Cracks NSA’s 25-Year-Old Cryptography Challenge in Minutes

Key Takeaways

• Anthropic’s Claude AI model has uncovered the 25-year-old mystery behind the origins of several NSA-supplied elliptic curve seeds.
• The seeds for NIST curves P-192, P-224, P-256, P-384, and P-521, crucial for digital signatures, were generated using an older C library random-number generator, lrand48, initialized with Unix timestamps from 1997-1998.
• This discovery provides historical clarity on how public security parameters were chosen, dispelling theories of hidden backdoors, but does not reveal secret keys or expose new cryptographic weaknesses.
• The findings do not necessitate changes to existing deployments or cryptographic systems.

Claude AI Unravels 25-Year NSA Cryptography Enigma

Anthropic has announced that an internal research model of its Claude AI has successfully identified the origins of five elliptic curve seeds provided by the National Security Agency (NSA), solving a cryptographic puzzle that has remained open for approximately a quarter-century. The AI accomplished this feat in under 30 minutes, shedding light on the selection process for significant public security parameters without exposing secret keys or compromising existing encryption.

In a report published October 16, 2026, Anthropic researchers detailed how the seeds underpinning NIST curves P-192, P-224, P-256, P-384, and P-521 were traced back to lrand48, an older C library pseudo-random number generator. This generator was found to have been initialized using Unix timestamps. The revelation directly challenges a long-standing conjecture that these values might have been derived from hashes of obscure or humorous phrases.

NSA Curve Seeds Sparked Decades of Speculation

The Elliptic Curve Digital Signature Algorithm (ECDSA) was incorporated into NIST’s FIPS 186-2 standard in 2000. Digital signatures are fundamental for verifying data authenticity and integrity. While the standard disclosed the seeds utilized in a SHA-1-based process to derive curve parameters, it conspicuously omitted any explanation regarding the seeds’ provenance.

This lack of transparency fueled concerns within the cryptographic community that the NSA might have deliberately chosen curves with undisclosed weaknesses. Although no practical attacks against these curves had ever been demonstrated, the absence of a clear narrative about their selection fostered mistrust. Former NSA mathematician Jerry Solinas reportedly recalled phrases like “Give Bob and Jerry a raise,” which contributed to earlier research efforts focusing on potential hash inputs.

The implications of this historical clarity extend beyond academic curiosity. For instance, Apple’s PQ3 iMessage protocol, a subject previously covered by Cybersecurity News, employs ECDSA with P-256 for message authentication. Understanding the historical context of these widely used parameters is crucial for maintaining confidence in the security of such critical services.

Claude Reconstructs the Generation Process

Diverging from the prevailing “phrase theory,” Claude’s approach involved analyzing random number generators commonly used in software development during the 1990s. The AI developed a scanner capable of evaluating 34 combinations of generators and their output slices, systematically searching for patterns within the publicly available seeds.

A significant clue emerged from some binary-curve seeds: their 32-bit words consistently exhibited a zero in the highest bit. This characteristic matched the behavior of lrand48, which returns 31 bits from a 48-bit internal state. Claude then successfully recovered candidate internal states by testing the remaining 17 hidden bits and validating subsequent outputs.

The prime-curve seeds presented a more complex challenge, as they retained only eight bits from each generator output. For these, Claude leveraged the Lenstra–Lenstra–Lovász (LLL) lattice reduction algorithm to reconstruct the internal states from partial values. This method confirmed that five NIST seeds and five ANSI X9.62 example seeds shared the same underlying construction.

By reversing the generator’s operation, the AI identified initialization values corresponding to Unix timestamps between May 1997 and April 1998. Specifically for P-256, the published seed was determined to be the 1,842nd candidate generated from a run initialized on August 16, 1997, at 01:52:34 UTC, with each candidate comprising 20 bytes.

Four binary-curve seeds also aligned with this generator. Their values suggested a clock value divided by two, although researchers presented this interpretation as a possibility rather than a confirmed fact.

Anthropic emphatically clarified that this discovery does not constitute a cryptographic break, a novel attack, or a previously unknown weakness in ECDSA. These are public curve-generation seeds, distinct from private signing keys. Their reconstruction does not enable an attacker to forge digital signatures. The researchers underscored that the simple, repeatable nature of the generation process makes deliberate manipulation less credible.

This work further exemplifies the growing role of AI in cryptographic research, following previous reports by Cybersecurity News on Claude’s capabilities in analyzing cryptographic vulnerabilities. In this instance, however, the outcome is enhanced historical understanding rather than the development of improved attack vectors.

Beyond the curve seeds, Claude also traced the base-point generation for P-192 and five ANSI example curves to FreeLIP, a long-integer arithmetic package. Base points, which are fixed starting points used in public key calculations, have origins separate from the curve seeds.

The historical account remains incomplete in some areas. The seed for B-163, along with several base points, still lacks an explanation. Researchers also noted skipped candidates, such as P-256 candidate 876, which appeared suitable but were evidently rejected for unknown reasons. Consequently, while the findings bolster confidence, they do not definitively prove that every selection decision was benign.

Anthropic has made the reproduction code publicly available to allow independent verification of their findings. The Internet Security Research Group is slated to receive a $36,864 bounty for this work. The report concludes that this discovery alone does not warrant any changes to currently deployed systems.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.