The Claude NSA seed mystery – a quarter-century fixation of cryptographic folklore – has finally cracked open, and the answer is far less cloak-and-dagger than the conspiracy theories that outlived it. Anthropic says its Claude model traced the suspicious 160-bit seed values the NSA handed NIST in the late 1990s to a mundane Unix random-number generator seeded with timestamps from 1997 and 1998, all in under 30 minutes.
The company published the research on Thursday, with CoinDesk among the first outlets to carry it Friday. For an industry that has spent 25 years reading backdoors into a handful of hex strings, “a C library with a sloppy clock” is not the twist anyone had on the bingo card.
What the Claude NSA seed mystery actually was
In the late 1990s, the NSA supplied seed values used to generate parameters for five NIST elliptic curves (P-192, P-224, P-256, P-384 and P-521) – curves that now underpin much of the world’s digital signatures, including TLS, code signing and much of the crypto ecosystem’s non-Bitcoin security stack. Because the seeds were secret inputs, a durable theory held that the agency had planted a weakness – a deliberate backdoor – while the work was long attributed to NSA mathematician Jerry Solinas.
How Claude solved it – and why Bitcoin shrugs
Claude noticed something statistically rude: the top bits of each seed chunk were consistently zero, a roughly 1-in-5,810 pattern. Sliding a window across the seeds, it recovered a 48-bit pseudorandom state by brute-forcing 17 hidden bits, then reproduced the seeds exactly – the P-256 seed matched on the 1,842nd candidate, corresponding to the Unix timestamp 1997-08-16 01:52:34 UTC. The generator turned out to be the C library’s lrand48 PRNG. A related finding tied several curve base points to the FreeLIP arithmetic package.
Anthropic is careful about what this does not mean: it is not a break, an attack or a weakness in the curves themselves, and no user action is required. The mundane, reproducible origin actually makes a deliberate backdoor less plausible – though it is a vivid reminder of how terrifyingly unsexy the randomness that secures secrets can be. Bitcoin, for its part, uses secp256k1, a curve defined by two small constants with little room for hidden mischief, and is unaffected.
A few loose ends remain: the B-163 seed and the base points of P-224, P-256, P-384 and P-521 are still unexplained. Anthropic’s $36,864 bounty for the puzzle went to the Internet Security Research Group, the nonprofit behind Let’s Encrypt – so at least the backdoor hunt ended on a good deed.
For crypto readers, the takeaway pairs neatly with this week’s Google Willow quantum breakthrough coverage: the systems guarding digital value are being probed by new AI tooling faster than ever, and the honest answers so far are reassuring rather than alarming.
