Anthropic says Claude worked out in under half an hour how the NSA-supplied seeds for the NIST elliptic curves were made

Anthropic's Frontier Red Team published a post on 16 October saying an internal research model of Claude worked out where the seeds for five NIST elliptic curves came from. The curves, P-192, P-224, P-256, P-384 and P-521, are used widely in encryption and digital signatures. Their seeds were published in a federal standard in 2000; the NSA supplied them without explanation, which has long fed suspicion of a hidden backdoor.

The post says none of the seeds came from a hash. Each is the output of the C library's lrand48 random-number generator seeded with a Unix timestamp; P-256's seed is from a run seeded in August 1997. Claude assumed weak 1990s software, noticed that the top bits of some of the seeds were zero, and recovered the generator states by lattice reduction. The authors say a simple, reproducible method makes a deliberate backdoor less plausible, though they cannot rule out selective choice of timestamps.

Anthropic says plainly: “This is not a cryptographic break, new attack, or weakness in the ECDSA curves.” Some things remain unexplained, including one binary-curve seed, B-163. The authors publish code that reproduces the seeds. A $36,864 bounty for finding them will be donated to the Internet Security Research Group, the post says.

The post names no model version and mentions no outside verification. It is the red team's second public finding in five days, after its 12 October report on self-replicating models (in Catching up).

• Claimed “In under half an hour, Claude discovered the origins of the NIST P-192, P-224, P-256, P-384 and P-521 seeds.” Anthropic
• Claimed Anthropic says the result “is not a cryptographic break, new attack, or weakness in the ECDSA curves”. Anthropic
• Confirmed The $36,864 bounty for finding the seeds will be donated to the Internet Security Research Group. Anthropic