An Anthropic research model has traced five unexplained seeds behind NIST elliptic curves, supplied by the National Security Agency in the late 1990s, to lrand48, an ordinary random-number generator found in older C software libraries. The model needed less than half an hour to solve a question cryptographers had pursued for 25 years.

Claude reproduced the sequence behind P-256, a widely deployed curve, and found an exact match for its published seed at the 1,842nd candidate. "This is astonishing: it solves the 25-year-old mystery," the model wrote in its recorded reasoning, before adding: "Wow, it's a real discovery."

Why the seeds mattered

Much of the internet relies on elliptic-curve cryptography, the same family of mathematics that protects bitcoin wallets. In 2000, the U.S. National Institute of Standards and Technology adopted a set of curves supplied by the NSA without explaining the origin of the starting numbers, called seeds. The seeds were public, but the agency never disclosed how it chose them.

Suspicion hardened after the Snowden disclosures linked the NSA to efforts to weaken cryptographic standards, and NIST later removed the Dual EC random-number generator from its recommendations. Cryptographers Neal Koblitz and Alfred Menezes examined the controversy in their 2015 paper, "A Riddle Wrapped in an Enigma." Menezes recalled receiving the seeds from NSA mathematician Jerry Solinas in 1997.

In 2023, cryptography engineer Filippo Valsorda and other contributors posted a $12,288 bounty for an answer, rising to $36,864 if donated to charity. Solinas had died earlier that year, leaving researchers with old recollections and the numbers themselves — and no outcome.

What does the discovery change for practitioners?

Anthropic says the finding makes a hidden NSA backdoor much less likely, and users of the NIST curves do not need to change anything. Anyone can now rerun lrand48 with timestamps from 1997 and 1998 and retrace its path to the published numbers. Questions remain: the team still cannot explain why the program passed over some usable candidates, or how other elements of the curves were selected.

The operational lesson cuts the other way. That predictability is precisely what let Claude rebuild the numbers — and it would be a disaster inside a wallet. A secret key generated with lrand48 could be recreated by anyone who worked out roughly when it was made, handing them everything needed to drain the funds. The NSA's seeds were public from day one, so there was never a secret to steal.

Bitcoin's position

Bitcoin was never part of this guessing game. Its wallets run on secp256k1, a curve built from a simpler equation and defined by two small, fixed numbers that leave almost nothing to adjust. P-256's version carries a 77-digit number that came out of the NSA's unexplained seed. With so few dials to turn, cryptographers have long argued, there was little room to quietly build a weakness into bitcoin's curve.

Satoshi Nakamoto never publicly explained the choice, and the curve was rarely used before bitcoin made it famous. Ethereum later adopted it, and bitcoin retained it through the 2021 Taproot upgrade, which introduced a newer signature style.

A sufficiently powerful quantum computer would present a separate danger: it could work backward from a public key visible on Bitcoin's blockchain to the secret key behind it, regardless of how the curve was chosen. Google said this week its Willow chip cut errors roughly 40-fold in one of the costliest steps such a machine would need. No one has yet built a quantum computer large or reliable enough to crack a bitcoin key, and there is no clear timeline for one.

The 25-year search did have a winner of sorts: the $36,864 bounty will go to the Internet Security Research Group, the nonprofit behind Let's Encrypt. For practitioners, the episode closes one audit question on the NIST curves while leaving bitcoin's quantum exposure — and its eventual migration path — firmly open.