# Anthropic traces NIST curve seeds to an old C random generator

> Anthropic says Claude helped reconstruct how several NIST and ANSI curve seeds were generated. Its code matches published values, while some base points and selection choices remain unexplained.

By BIG CHANGE Editorial

Published: 2026-10-17T04:34:13.533Z
Updated: 2026-10-17T04:34:13.533Z
Canonical: https://bigchange.ai/blog/anthropic-nist-curve-seeds-lrand48-origins

![Conceptual charcoal illustration of an analog clock in a dark metal housing with an orange thread looping from its side.](https://bigchange.ai/api/media/file/anthropic-ecdsa-clock-seed-concept-v1.png)
AI-generated conceptual illustration by BIG CHANGE; no historical generator, security breach or independently verified calculation is depicted.

Anthropic says a research version of Claude helped its cryptography team reconstruct where several published elliptic-curve seeds came from. The [October 16 report](https://www.anthropic.com/research/ecdsa-curve-origins) links five NIST prime-curve seeds and four NIST binary-curve seeds to outputs of `lrand48`, an older C pseudorandom generator initialized from clock-derived values. It also supplies code that prints the reported seeds and reproduces selected base-point coordinates.

The result addresses a question about the history of standardized parameters. Anthropic reports no new attack or cryptographic break. Its reconstruction also leaves some choices unexplained, including why certain viable candidate curves were passed over.

## The big change

- **What changed:** Anthropic published a specific generation recipe and code for the seeds of NIST P-192, P-224, P-256, P-384 and P-521, four NIST binary curves, and five ANSI X9.62 example curves. Its separate base-point recipe matches P-192 and five ANSI examples.
- **How:** The team reports that Claude recognized patterns in the published seed bits, recovered generator state, and walked the state backward to clock-shaped initial values. For six base points, it identified a generator used in older long-integer software.
- **Limit:** The code makes the proposed matches inspectable, but a matching recipe does not document every historical selection decision or establish the curves' security. BIG CHANGE reviewed the public post and historical standard; it has not run an independent reproduction.

## What a curve seed explains

[NIST's archived FIPS 186-2](https://csrc.nist.gov/files/pubs/fips/186-2/final/docs/fips186-2.pdf), dated January 27, 2000, lists a 160-bit seed for each of its five prime-field curves. A specified SHA-1-based process turns the seed into a curve coefficient. The standard also lists the field, curve order and base-point coordinates separately. It says the supplied seed lets a reader check that the coefficient follows the specified process; it does not describe how the seed itself was chosen. Nor does the seed determine the base point, the fixed point used to form public keys.

That distinction defines the scope of Anthropic's finding. Tracing a seed can explain one input to the standardized curve. Explaining the base point requires another account, and a matching output cannot reveal every decision made by the people selecting parameters.

## How Anthropic traced the seeds

According to Anthropic, Claude first looked for signatures of older C pseudorandom generators in the published values. In some binary-curve seeds, every 32-bit word had its top bit clear. Anthropic says the pattern led to `lrand48`, which returns 31 bits from a 48-bit internal state. The model then recovered possible states and checked whether successive outputs matched the seeds. For prime curves, fewer bits of each output were retained, so Anthropic says Claude used a lattice method to recover the hidden state.

The [code in Anthropic's post](https://www.anthropic.com/research/ecdsa-curve-origins#code-to-reproduce-the-seeds) starts from a `srand48`-style state, advances the `lrand48` recurrence and prints 20-byte candidate seeds. Its table specifies timestamps and candidate numbers for P-192, P-224, P-256, P-384 and P-521, plus the ANSI examples prime192v2, prime192v3 and prime239v1 through prime239v3. For P-256, the specified run reaches the published seed at candidate 1,842. The P-256 value printed in Anthropic's example matches the seed in FIPS 186-2.

Anthropic reports a related match for B-233, B-283, B-409 and B-571. Their code uses a clock value divided by two before initializing the generator. Anthropic describes this halved-clock interpretation as a possibility: walking the recovered state back produced dates in February 1984, while doubling the values corresponds to April 17, 1998. The published match supports the generator recipe; it does not establish which clock-handling choice the original authors made.

Anthropic describes the work as a collaboration between an employee's question, the internal research model's search and code, and checks by its team. The report provides code and example output that others can inspect. We found no independent reproduction to cite for this article, and BIG CHANGE did not execute the code. The source therefore supports describing this as Anthropic's reported reconstruction, with the historical NIST values serving as an external record of the target parameters.

## Six base points and the remaining gaps

Anthropic says a different old generator, from Arjen Lenstra's FreeLIP long-integer package and early versions of Victor Shoup's NTL, matches the base-point x-coordinates for P-192 and five ANSI examples. Its [second code listing](https://www.anthropic.com/research/ecdsa-curve-origins#code-to-reproduce-selected-base-points) seeds that generator with small integers, discards seven outputs, then draws candidate x-coordinates until one lies on the curve. The six examples are P-192, prime192v2, prime192v3 and prime239v1 through prime239v3. Anthropic prints a match for each published x-coordinate. NIST's historical P-192 listing supplies the value used for that comparison.

Several limits remain in Anthropic's own account. It could not recover the B-163 seed. It did not explain the base points of P-224, P-256, P-384 or P-521, or those of the NIST binary curves. The runs also passed over candidates that Anthropic says would have met the stated size and prime-order conditions. P-256's candidate 876 is one example, before the published candidate 1,842; Anthropic reports three skipped viable candidates in the P-224 run and seven across two ANSI example runs. The team does not know the selection criterion or whether those skips were an artifact.

For security engineers, the useful new artifact is a checkable account of many parameter values' apparent generation path. It narrows one long-standing question about opaque seeds without answering every question about curve selection. Anthropic itself says the finding is not a reason for users to change cryptographic practice.

## Sources & further reading

- [Anthropic, “Claude reveals ECDSA curve origins” (October 16, 2026)](https://www.anthropic.com/research/ecdsa-curve-origins). The team's account of the model's role, seed and base-point reconstructions, code listings, outputs and open questions. Its conclusions remain the team's reported findings; BIG CHANGE did not independently run the code.
- [NIST, *FIPS 186-2: Digital Signature Standard* (January 27, 2000; archived)](https://csrc.nist.gov/files/pubs/fips/186-2/final/docs/fips186-2.pdf). Appendix 6 lists the historical curve seeds, coefficients and base-point coordinates and describes how published seeds are used. This is a parameter record, not an explanation of the original seed choices.
- [Neal Koblitz and Alfred Menezes, “A Riddle Wrapped in an Enigma” (2015; updated 2018)](https://eprint.iacr.org/2015/1018.pdf). Historical discussion of speculation around elliptic-curve standards. It predates Anthropic's reconstruction and does not validate the new calculations.

## Sources

- [Claude reveals ECDSA curve origins](https://www.anthropic.com/research/ecdsa-curve-origins) — Anthropic's claim, method, code, output and limits; company-authored evidence, not independent validation.
- [FIPS 186-2: Digital Signature Standard](https://csrc.nist.gov/files/pubs/fips/186-2/final/docs/fips186-2.pdf) — Archived historical standard listing NIST seeds, coefficients and base points and describing seed verification. Does not explain original seed selection.
- [A Riddle Wrapped in an Enigma](https://eprint.iacr.org/2015/1018.pdf) — Historical discussion of standards concerns; predates and does not validate Anthropic's reconstruction.