Claude traces the NIST elliptic-curve seeds to lrand48 seeded with 1997–98 timestamps, settling a 25-year backdoor question

In FIPS 186-2 (2000), NIST published the P-192/224/256/384/521 curves, whose coefficient b is derived by SHA-1 from a 20-byte seed supplied by the NSA without explanation, fueling 25 years of backdoor suspicion. Anthropic reports that an internal research model, asked without hints, found the answer in under half an hour: it guessed the generator was a 1990s C-library PRNG, scanned 34 generator/slice combinations, noticed four seeds had the top bit clear in every 32-bit word (about 1/5810 by chance), identified lrand48, recovered the truncated lrand48() >> 23 state with LLL lattice reduction, and stepped it back to srand48 form. Every prime-curve init value is a Unix timestamp between May 1997 and April 1998; P-256 is candidate #1842 after srand48(871696354), i.e. 1997-08-16 01:52:34 UTC. Filippo Valsorda reproduced it independently in Go, and we reproduced the P-256 seed locally from Anthropic's published Python in about 5 ms. The model also explained base points for P-192 and five ANSI X9.62 example curves (FreeLIP RNG), but B-163's seed, the P-224/256/384/521 base points, and why some viable candidates were skipped remain open. The $36,864 bounty, claimed on 2026-10-15, goes to ISRG. Anthropic stresses this is not a cryptographic break; no action is needed, and the result makes a hidden weakness less plausible.