Were the NIST curves backdoored? Claude traced the ECDSA curve seeds to a 1990s random number generator

Were the NIST curves backdoored? For more than 25 years nobody could say where the random-looking seeds behind P-256 and the other NIST ECDSA curves came from. On October 16, 2026, Anthropic said one of its internal models had found the answer: the seeds weren't hashes of a secret phrase, as long rumored, but the output of a common C library random number generator, seeded with the clock in 1997 and 1998. The cryptographer who ran a public bounty for the seeds checked the method and confirmed it. The finding removes the main seed-based backdoor theory. It doesn't explain everything about how the curves were chosen.

This story is based on Anthropic's research post and reproduction code, Filippo Valsorda's verification post, NIST's curve standards, the arXiv paper behind Anthropic's companion quantum post, CoinDesk's coverage and the Hacker News discussion (labeled as community comment), checked October 18, 2026.

The short version

• What was found: the seeds for NIST P-192, P-224, P-256, P-384 and P-521 are output of the lrand48 generator seeded with Unix timestamps between May 1997 and April 1998, according to Anthropic. P-256's seed came from August 16, 1997, after 1,842 iterations, per Anthropic's code.
• Who found it: "an internal research model," Anthropic says, in "under half an hour." The post doesn't name the model. Ten Anthropic researchers are credited.
• Who checked it: Filippo Valsorda, organizer of the NIST curve seeds bounty, reimplemented it in Go. Anthropic published reproduction code under CC0.
• What it rules out: the idea that someone searched freely through hashed phrases to pick weak curves. Valsorda says the process left "barely 30 bits of freedom."
• What's still open: how the base points for P-224, P-256, P-384 and P-521 were made, one binary-curve seed (B-163), and why some valid candidate seeds were skipped.
• What to do: nothing, Anthropic says. "This is not a cryptographic break, new attack, or weakness in the ECDSA curves."

Why did people think the NIST curves might be backdoored?

The NIST prime curves were generated "verifiably at random" under the ANSI X9.62 standard: a 160-bit seed was hashed with SHA-1 and the output used to derive curve parameters, as Valsorda's bounty page explains. That proves the parameters came from the seed. It doesn't prove the seed was chosen innocently.

NSA employee Jerry Solinas supplied the seeds in fall 1997, according to cryptographer Alfred Menezes, as quoted in Steve Weis's long-running investigation. In 2015 Solinas recalled that the seeds were hashes of a phrase "along the lines of 'Give Bob and Jerry a raise'," but said no records survived.

The worry was that whoever picked the seeds could have tried many phrases until SHA-1 produced a curve with a weakness only they knew about. Daniel Bernstein and Tanja Lange described that kind of search: according to Valsorda, they told Koblitz and Menezes in 2017 of a technique that could have used 70 bits of freedom in choosing the seed to target a hypothetical class of weak curves. Neal Koblitz and Menezes reviewed the debate in a 2015 paper, "A Riddle Wrapped in an Enigma."

NIST still recommends the curves. Its February 3, 2023 update, FIPS 186-5 and SP 800-186, keeps ECDSA with the prime curves, adds Edwards curves for EdDSA and deprecates the binary curves.

What did Claude find?

According to Anthropic's post, Claude started from a guess: the seeds might be raw output from a weak 1990s pseudorandom generator rather than hashes. The steps it describes:

1. It wrote a scanner that looked for consecutive outputs of 34 generator and bit-slice combinations inside each seed.
2. It noticed that in four seeds the top bit of every 32-bit word was zero, which Anthropic puts at about a 1-in-5,810 chance. That matches lrand48, which returns 31 bits from a 48-bit internal state.
3. It brute-forced the 17 hidden bits of that state (2^17 values) and, for the prime-curve seeds, recovered the truncated state with LLL lattice reduction.
4. It stepped each state back to the starting form srand48 produces, which revealed a Unix timestamp.

The prime-curve timestamps fall between May 1997 and April 1998. Anthropic says each recovered 48-bit state "regenerates all 160 bits of its seed, which does not happen by chance." It concludes the seeds came from "a common pseudorandom number generator initialized from the clock, which anyone can now reproduce."

Claude also explained the base point of P-192 and of several ANSI example curves, which came from a generator in Arjen Lenstra's FreeLIP library, Anthropic says. Four of the five NIST binary-curve seeds fit as well, with timestamps that make sense if the program halved the clock. The base points of P-224, P-256, P-384 and P-521, and the B-163 seed, remain unexplained.

Anthropic calls the generator lrand48. Valsorda's post calls it drand48. Both belong to the same POSIX family of functions, which the standard says use "a linear congruential algorithm and 48-bit integer arithmetic"; the two sources name different output functions of that one generator.

Did independent cryptographers confirm it?

Yes, the person best placed to check did. Valsorda, who announced the bounty on October 5, 2023, wrote on October 16, 2026 that Anthropic's team claimed it at 01:07:51 UTC on October 15, and that he reimplemented the generation process in Go. His conclusions:

• "This week's findings completely rule out the technique described by Bernstein and Lange."
• Even on generous assumptions, the people generating the curves "would have had barely 30 bits of freedom," which is "not enough to embed any kind of NOBUS backdoor." NOBUS ("nobody but us") means a weakness only the designer can exploit.
• He would "now personally recommend" the NIST curves over Curve25519/Ed25519/X25519, "just in time for them to be retired in favor of post-quantum signatures."

The team donated the prize to ISRG, the nonprofit that runs Let's Encrypt. Under the bounty's rules that tripled it from $12,288 to $36,864.

Steve Weis, whose blog post pulled together the seeds' history in 2023, is a co-author of Anthropic's post, so he isn't an outside reviewer here.

What does it prove about backdoors, and what doesn't it?

What it shows. The seeds came from a simple, reproducible process with little room for choice. Anthropic says this "makes us more confident the curves were chosen without any backdoors or intentional weaknesses." Valsorda says it rules out the hashed-phrase search entirely.

What it doesn't show. It isn't a proof that the curves have no weakness. Three gaps remain:

• Skipped seeds. Valsorda found that the published seeds pass two checks that weren't documented, one of which "still escapes us." That leaves "roughly twice as many valid seeds as were published," and the gaps between accepted seeds aren't regular. Anthropic notes, for example, that P-256's candidate 876 was passed over. Because the number of skipped candidates is small, Anthropic says it doesn't believe it is plausible that weakened curves were selected.
• Base points. How the base points for P-224, P-256, P-384 and P-521 were generated is still unknown.
• The search over timestamps. "Nothing in the numbers shows how many runs there were," Anthropic writes. Some Hacker News commenters argued that someone could have tried many timestamps until one produced a weak curve. Valsorda's 30-bit estimate is the answer to that: even allowing any timestamp in 1997–98 and any of the first 16 prime-order candidates, the freedom was far too small for a hidden class of weak curves. His bounty page also notes the older argument that such a class would have to be so large that it's implausible academia never found it.

Community reaction, which is opinion rather than evidence, ran from relief to skepticism. On Hacker News, where the post drew more than 1,000 points and 383 comments by October 18, the user tptacek wrote that "nobody conversant with elliptic curve cryptography research believed there was a backdoor based on these seeds." Other commenters said the result "hardly proves the NSA has nothing up their sleeve."

Should you stop using P-256?

No. Anthropic says "there is no action to be taken or things to do differently," and Valsorda now argues for the NIST curves. The real long-term risk to P-256, and to every elliptic curve, is a large quantum computer. NIST says it doesn't expect these signature algorithms to withstand one and is standardizing post-quantum replacements. How the seeds were chosen doesn't change that.

What's in the quantum circuits paper?

Anthropic published a second post the same day, "Designing more efficient quantum circuits with Claude," backed by an arXiv paper, "Discovering state-of-the-art quantum circuits with large language models" (arXiv:2610.22367, dated October 15, 2026). The results come from the authors, not an independent evaluation. According to the post and paper:

• Who: led by Andi Gu (Anthropic STEM Fellows Program and Harvard) with Alek Kemeny of Anthropic, and Susanne Yelin and Mikhail Lukin of Harvard (Lukin is also at QuEra Computing). Claude Mythos 5 proposed the designs inside the OpenEvolve search framework.
• What: Claude got plain-language specifications for eight quantum circuits and worked in a closed loop. An external evaluator program checked each circuit's correctness and scored it by its Toffoli-gate count multiplied by its peak qubit count. The paper says the designs cut both Toffoli and qubit counts against the best published circuits in seven of the eight tasks.
• Elliptic-curve point addition: the eighth task, on a 256-bit prime-field curve (the paper's parameters are those of secp256k1, the curve Bitcoin uses). Here Claude built a new reversible modular-inversion method rather than beating every prior design on both counts. Its main circuit uses 4.0 million Toffoli gates and 935 qubits. Against the prior design with the fewest qubits (Luo et al., 70 million Toffolis, 838 qubits), that is about 17 times fewer gates for 12% more qubits, the comparison Anthropic highlights. Against the prior design with the fewest gates (Schrottenloher, 1.9 million Toffolis, 1,446 qubits), it uses about twice the gates but 511 fewer qubits. Anthropic says the run took 53 hours.
• Reed-Solomon decoder: 0.44 million Toffoli gates versus 5.1 million for the previous construction by Khattar et al. at Google Quantum AI, about 12 times fewer. About one run in 10,000 fails, which Anthropic says is within the task's allowed error rate (the paper sets the budget at one in 1,000).

Point addition is the core step in quantum algorithms for the elliptic-curve discrete logarithm problem, the math behind ECDSA. Anthropic says improvements like these could mean practical quantum computers "arrive sooner than previously anticipated," but gives no estimate of when attacks on ECDSA might become practical, and fewer gates on paper isn't the same as a working machine.

What's confirmed, reported and uncertain

• Confirmed (Anthropic, with published code): the seeds for the five NIST prime curves reproduce from lrand48/drand48 seeded with 1997–98 timestamps; P-192's and several ANSI base points reproduce from a FreeLIP-style generator.
• Confirmed independently: Valsorda reimplemented the seed generation and accepted the bounty claim.
• Vendor-reported: that Claude did the work "in under half an hour"; all quantum circuit results (published in the arXiv paper, not yet independently replicated).
• Uncertain: the P-224, P-256, P-384 and P-521 base points; the B-163 seed; the undocumented acceptance criterion behind the skipped seeds; which Claude model did the seed work.

For more on Anthropic's security research, see our coverage of the Frontier Red Team's IoT self-replication study and the Cyber Mission and OSS Scanner. For what Anthropic says about its models' cyber capabilities, see what the Claude Opus 5.5 system card says, how to read a system card and Bank of America's Claude Mythos remediation work.