Anthropic says its Claude model has solved a 25-year-old cryptography mystery: the unexplained numbers the NSA supplied for NIST’s standard elliptic curves came from an ordinary 1990s random number generator, not a secret design. Why it matters: the finding makes a hidden NSA backdoor in some of the internet’s most-used encryption much less likely.
October 17, 2026 — Anthropic disclosed the result on Friday, October 16, and CoinDesk reported the details early Saturday.
What happened
In 2000, the U.S. National Institute of Standards and Technology (NIST) adopted a set of elliptic curves supplied by the National Security Agency. Each curve was built using a published starting value, called a seed, but the NSA never explained how those seeds were chosen. That silence fed a durable suspicion: that the agency might have searched through many possible values until it found curves with a weakness only it knew about.
The suspicion hardened after the Snowden disclosures linked the NSA to efforts to weaken cryptographic standards. Cryptographers kept asking where the seeds came from. The best-known lead came from NSA mathematician Jerry Solinas, who recalled in 2015 that the seeds might be hashes of a humorous phrase he had forgotten. Solinas died in 2023, and a bounty offered that year by cryptography engineer Filippo Valsorda and other contributors — $12,288, rising to $36,864 if donated to charity — went unclaimed.
How Claude found the answer
Anthropic says an employee asked an internal research version of Claude to investigate the seeds this month, without passing on the old joke-phrase theory. In less than 30 minutes, the model traced five NIST curve seeds to lrand48, a random number generator found in older C software libraries, started from Unix timestamps in 1997 and 1998. For the widely used P-256 curve, Claude reproduced the sequence and found an exact match for the published seed at the 1,842nd candidate.
Because lrand48 is predictable, anyone can now rerun the process and arrive at the same numbers the NSA supplied. Anthropic says that reproducibility is the point: the seeds look like the output of a straightforward period tool, not the product of a hidden search for weak curves. The company also says people using the NIST curves do not need to change anything.
What is still unexplained
The result does not close every question. Anthropic’s team still cannot explain why the generation process passed over some usable candidates, or how other parts of the curves were chosen. The discovery is also not an attack: the seeds were always public, so there was never a secret to steal, and reconstructing them does not expose private keys or weaken signatures made with the standard. Bitcoin is separate from the story — it uses a different curve, secp256k1, built from small fixed numbers that leave little room to hide anything.
The bounty will go to the Internet Security Research Group, the nonprofit behind Let’s Encrypt, which provides free security certificates to websites.
Why it matters
The curves at issue sit underneath a large share of the web’s encrypted connections and digital signatures, so a 25-year-old unanswered question about their origins was a real trust problem, not trivia. Claude’s contribution was not breaking encryption — it was doing the patient pattern-spotting across decades-old software that human investigators had not connected. That is the pattern worth watching for subscribers: frontier models are increasingly useful at auditing the foundations everyone else takes for granted. Everything AI, tested — including, this week, the mathematics the internet is tested against.
Frequently asked questions
Did Claude break the encryption used by websites and wallets?
No. Claude reconstructed how public curve parameters were originally generated. It did not recover anyone’s private keys, and Anthropic says users of the NIST curves need to take no action.
Which curves did the finding cover?
The seeds for five NIST curves — P-192, P-224, P-256, P-384 and P-521 — were traced to the lrand48 generator seeded with timestamps from 1997 and 1998.
Does this prove there was no NSA backdoor?
It makes a deliberate hidden weakness much less likely, because the seeds can now be reproduced from an ordinary generator. Anthropic notes some details of the selection process remain unexplained.
What happened to the bounty for solving the mystery?
The $36,864 bounty will be donated to the Internet Security Research Group, the nonprofit behind Let’s Encrypt.
Sources: CoinDesk, The Arabian Post, MadRobot, Anthropic (via reporting)