Does Anthropic's ECDSA seed finding mean P-256 is broken?

No. Anthropic says its ECDSA curve-origins result is not a cryptographic break, a new attack, or a weakness in the curves. It only explains how the published seeds were produced. Anthropic's post says there is no action to take and nothing to do differently, so systems using P-256 and the other NIST curves do not need changes.

Which NIST curve parts are still unexplained after Anthropic's work?

Anthropic lists open questions: the seed for binary curve B-163, the base points of P-224, P-256, P-384, P-521 and the NIST binary curves, and why some valid candidates were skipped. For P-256, candidate 876 also gives a valid curve, but candidate 1842 was published. Six base points, including P-192's, trace to the FreeLIP random generator.

Who gets the NIST seeds bounty that Claude's result claims?

The NIST elliptic curve seeds bounty, organised by Filippo Valsorda, totals $36,864. Anthropic says the money will be donated to the Internet Security Research Group, the nonprofit behind Let's Encrypt. The bounty page on words.filippo.io describes the original challenge to explain where the NSA-supplied seeds came from.

Can I check Anthropic's ECDSA seed reconstruction myself?

Yes. Anthropic published Python code on the ECDSA curve-origins page that reproduces the seeds and selected base points, released under the CC0 1.0 public-domain license. Each recovered 48-bit lrand48 state regenerates all 160 bits of its published seed, which Anthropic notes does not happen by chance.

Anthropic · 2026-10-16 · major

Claude explains the NIST ECDSA curve seeds — a 1990s clock-seeded generator

Anthropic's Frontier Red Team says an internal research model found that the seeds behind NIST curves P-192 to P-521 came from lrand48 seeded with a Unix timestamp, not from a hash. Anthropic says this is not a break of ECDSA.

Anthropic research post artwork for Claude reveals ECDSA curve origins

An Anthropic research model traced where the NSA-supplied seeds for the NIST elliptic curves came from, an open question for about 26 years.

Quick facts

Published by	Anthropic Frontier Red Team
Model	Internal research model (not named)
Curves explained	P-192, P-224, P-256, P-384, P-521 seeds
Seed source	lrand48 seeded with a Unix timestamp
Code license	CC0 1.0
Bounty	$36,864, donated to ISRG

What is it?

Anthropic's Frontier Red Team reports that an internal research model explained the published seeds for the NIST prime curves P-192, P-224, P-256, P-384 and P-521. The seeds were not hash outputs: they came from the C library's lrand48 random generator, seeded with a Unix timestamp from May 1997 to April 1998. The P-256 seed, for example, matches a timestamp of 1997-08-16 01:52:34.

How does it work?

The model guessed a weak 1990s random generator, wrote a scanner for 34 generator and output-slice combinations, and spotted a zero top bit that fits lrand48's 31-bit output. It brute-forced 17 hidden bits for the binary-curve seeds and used LLL lattice reduction to rebuild the generator state for the prime-curve seeds. Each recovered 48-bit state regenerates all 160 bits of its seed, and stepping it back lands on a plausible srand48 timestamp.

Why does it matter?

The unexplained seeds fed decades of suspicion that the NSA hid a backdoor in the curves. Anthropic argues the simple clock-based process makes a hidden backdoor much less plausible, and says there is no action to take. The result also claims Filippo Valsorda's NIST seeds bounty, which Anthropic will donate to the Internet Security Research Group. Some questions stay open, including the B-163 seed and most base points.

Who is it for?

cryptographers and security engineers

Frequently asked questions

Does Anthropic's ECDSA seed finding mean P-256 is broken?: No. Anthropic says its ECDSA curve-origins result is not a cryptographic break, a new attack, or a weakness in the curves. It only explains how the published seeds were produced. Anthropic's post says there is no action to take and nothing to do differently, so systems using P-256 and the other NIST curves do not need changes.
Which NIST curve parts are still unexplained after Anthropic's work?: Anthropic lists open questions: the seed for binary curve B-163, the base points of P-224, P-256, P-384, P-521 and the NIST binary curves, and why some valid candidates were skipped. For P-256, candidate 876 also gives a valid curve, but candidate 1842 was published. Six base points, including P-192's, trace to the FreeLIP random generator.
Who gets the NIST seeds bounty that Claude's result claims?: The NIST elliptic curve seeds bounty, organised by Filippo Valsorda, totals $36,864. Anthropic says the money will be donated to the Internet Security Research Group, the nonprofit behind Let's Encrypt. The bounty page on words.filippo.io describes the original challenge to explain where the NSA-supplied seeds came from.
Can I check Anthropic's ECDSA seed reconstruction myself?: Yes. Anthropic published Python code on the ECDSA curve-origins page that reproduces the seeds and selected base points, released under the CC0 1.0 public-domain license. Each recovered 48-bit lrand48 state regenerates all 160 bits of its published seed, which Anthropic notes does not happen by chance.

Try it

The post includes CC0 Python code that regenerates the seeds and selected base points.