A Decades-Old Cryptography Mystery Is Solved, and the Answer Is a Timestamp
Anthropic's Frontier Red Team published an explanation on Oct. 16, 2026, for one of cryptography's oldest open questions: where the seed numbers behind the NIST elliptic curves came from. The team says those starting values, which fix part of each curve, were not computed from a secret phrase as decades of lore held, but are the raw output of a pseudorandom number generator that shipped with 1990s C libraries, started from a computer's clock.
The curves are the ones NIST published in 2000 for ECDSA, the elliptic curve signature standard, and the seeds reached NIST from the NSA with no account of how they had been chosen. Anthropic's write-up says that gap left people wondering whether the parameters had been picked to contain deliberate backdoors, that a generator started from the clock makes that much less plausible, and that the result is not a cryptographic break.
Filippo Valsorda, who organized the bounty for the seeds' origin, reimplemented the algorithm in Go to verify the claim and announced that the bounty had been claimed. He says the Anthropic team donated the prize, $36,864, to the Internet Security Research Group, the nonprofit that runs Let's Encrypt. Valsorda writes that the result also rules out a technique described by Daniel Bernstein and Tanja Lange, which would have required searching many seeds for one that produced a weak curve.
Anthropic says one of its models found the answer in under half an hour, after an employee asked it how the seeds had been generated without passing on the passphrase rumor. The recovered starting values are timestamps from a machine's clock, dated between May 1997 and April 1998, the period the old account had also pointed to. Anthropic's page publishes public-domain code that regenerates the published seeds.
Parts of the record remain open. Anthropic says that one seed, for the B-163 curve, fits nothing it has tried, and that it could not work out how the base points of four curves, the fixed points every public key is built on, were chosen.
