> ## Content Index
> Fetch the complete content index at: https://all-about-ai.ghost.io/llms.txt
> Use this file to discover other available public pages before exploring further.

# Anthropic says Claude traced NIST’s mystery numbers to a 1990s random-number generator
- URL: https://all-about-ai.ghost.io/news/anthropic-says-claude-traced-nists-mystery-numbers-to-a-1990s-random-number-generator/
- Published: 2026-10-17T15:05:49.000Z
- Updated: 2026-10-26T15:11:19.000Z
- Description: Independent code reproduces ten exact seed matches from 1990s timestamps. The finding strengthens confidence in the curves, but leaves some selection choices unexplained.
- Author: Frontier Models Desk
- Tags: News, models-research, claude, anthropic

[Anthropic says Claude](https://all-about-ai.ghost.io/news/anthropic-says-claude-wrote-formal-proofs-for-code-in-123-libraries/) traced unexplained numbers behind widely used cryptographic standards to an ordinary random-number generator seeded with dates and times from 1997 and 1998\. Fresh code reproduced the five official NIST seeds exactly, and a separate verifier by cryptographer Filippo Valsorda reached the same result. The matches supply a checkable origin for numbers that have fueled backdoor suspicions for 25 years.

The seeds helped define elliptic curves used by the Elliptic Curve Digital Signature Algorithm, or ECDSA, to create signatures that verify authenticity and detect tampering. The NSA supplied the seeds without explaining their origin. Reconstructing these public design inputs exposes no secret and reveals no new attack, so users have no reason to change keys or software.

5NIST prime-curve seeds reproduced exactly

10Exact seed matches across NIST and ANSI curves

1,842Candidate that produced the P-256 seed

11Otherwise qualifying unpublished candidates still unexplained

P-256 provides the clearest example. Start the generator at August 16, 1997, at 01:52:34 UTC and draw successive groups of 20 bytes. The 1,842nd group matches the published P-256 seed exactly. The same recipe explains all five NIST prime-curve seeds and five additional ANSI example seeds, using six starting timestamps.

In its [October 16 account](https://www.anthropic.com/research/ecdsa-curve-origins?ref=all-about-ai.ghost.io), Anthropic says an employee asked an internal research model to investigate without giving it an old clue that the seeds might be hashes of a humorous phrase. Claude instead considered what software someone would have used in the 1990s.

It identified patterns consistent with `lrand48`, a pseudorandom-number generator supplied with C programming libraries. Such a generator produces a repeatable sequence from an initial state. Claude reportedly recovered that state from fragments of output, then worked backward to starting values that represented Unix timestamps, the number of seconds since the beginning of 1970.

A fresh implementation of the [documented generator](https://pubs.opengroup.org/onlinepubs/007904975/functions/drand48.html?ref=all-about-ai.ghost.io) matched all five NIST seeds in the [historical parameter tables](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf?ref=all-about-ai.ghost.io) at Anthropic's reported timestamps and candidate positions. The same code matched the five ANSI seeds against two public technical transcriptions; the paywalled ANSI standard itself was not consulted. Valsorda also published a [separately written verifier](https://github.com/FiloSottile/mostly-harmless/blob/main/seeds/seeds.go?ref=all-about-ai.ghost.io). Ten exact 160-bit matches make coincidence implausible, establishing the generator states far more firmly than the circumstances in which people selected the resulting curves.

That independently checkable result is separate from Anthropic's account of Claude's performance. The company says the model found the five NIST seed origins in under half an hour, but it has not identified the model version or published a complete session record. The exact matches stand either way; the timing and division of work between the model and researchers remain Anthropic's account.

A public seed is not a private key 

These seeds are public inputs used to construct the curves, not users' secret signing keys or the fresh secret values needed for individual signatures. A predictable, clock-seeded generator would be unsafe for those secrets. Reconstructing these public inputs instead helps explain the curves' origins, although it cannot reveal every choice made during their selection.

## The generator is explained. Some choices are not.

Matching the generator stream does not explain why every curve was selected. Many candidate seeds would fail the required tests and be rejected. Valsorda's verifier also applies an inferred extra rule: reject a curve if its order, the number of points in its group, needs more bits than the underlying field. That rule explains ten rejections in the P-224 and P-384 streams, but no contemporaneous document confirms that it was the rule actually used.

Even after applying that filter alongside the published ANSI checks, 11 qualifying but unpublished candidates remain: five in the prime239 stream, two in the P-192 stream, one before P-256 and three before P-224\. For P-256, candidate 876 already produces a prime-order curve of the right size, yet the standardized seed appears at candidate 1,842\. No tested additional rule, software bug or validation step explains all the gaps.

Those gaps leave room for undocumented selection, but they are not evidence of a backdoor. In [his analysis](https://words.filippo.io/seeds-solved/?ref=all-about-ai.ghost.io), Valsorda estimates roughly 30 bits of choice if a selector could try every second in 1997 and 1998 and choose among the first 16 prime-order candidates. That is far below the roughly 70-bit manipulation scenario discussed by [Daniel J. Bernstein and Tanja Lange](https://eprint.iacr.org/2024/1265.pdf?ref=all-about-ai.ghost.io). The estimate depends on that time window, candidate limit and the absence of unobserved runs. The recovered numbers cannot show how many other runs occurred.

[Current NIST guidance](https://csrc.nist.gov/pubs/sp/800/186/final?ref=all-about-ai.ghost.io), issued before this discovery, continues to permit P-224, P-256, P-384 and P-521 for ECDSA; P-192 is designated for legacy use. The reconstruction supplies no reason to change that guidance.

The reconstruction substantially strengthens the mundane explanation for the seeds. It does not prove that the standards were never manipulated. The remaining historical question is narrower and now precisely defined: why those 11 otherwise acceptable candidates were passed over.