Claude Cracked a 25-Year Crypto Mystery in 30 Minutes

The answer was always simple. That’s the unsettling part.

Anthropic announced on October 16 that Claude, its internal AI research model, determined how the National Security Agency generated the seed values embedded in five NIST elliptic-curve standards in less than 30 minutes. The seeds had been unexplained since 2000, feeding two decades of suspicion that the NSA might have intentionally weakened the curves.

The discovery does not break ECDSA. It does not hand attackers a new weapon. But it changes the conversation about who gets to solve problems at the intersection of mathematics, code, and institutional memory — and how fast AI can move from that intersection into areas once reserved for specialists.

The mystery that outlived its creators

The curves in question are FIPS 186-2, the 2000 standard that defined P-256, P-384, P-521 and related parameters used by billions of devices every day. Each curve carries a seed — a numeric constant that selects the curve from the mathematical space of possibilities. The seeds were supplied by the NSA. The method of generation was not documented.

That omission became a shadow in the field. When Bruce Schneier and others raised concerns about the possibility of a hidden trapdoor, the community had no way to verify or dismiss the claim. The seeds looked arbitrary. Arbitrary without explanation is what people fear most in cryptography.

Jerry Solinas, a former NSA cryptographer, offered a partial answer in 2015. He recalled — as a joke, he stressed — that the seeds might have been generated by hashing a passage of English text. But he could not name the text. Colleagues who had written the original code did not remember the procedure. Paper trails had gone missing. The best anyone could do was speculate.

For twenty-five years, the speculation persisted. It shaped audit requirements, influenced procurement decisions, and kept a low-grade distrust alive in security teams worldwide. It also meant that if the seeds were ever found to be weak, there would be no clear chain of custody to trace the decision.

What Claude actually found

Anthropic says a researcher asked Claude to investigate the seed origin. Within thirty minutes, the model returned a reproducer: the seeds were derived from lrand48, a pseudo-random number generator from a C library used in the mid-1990s. The seed value fed into lrand48 was a timestamp representing dates in 1997 or 1998, expressed as a numeric count. The generator’s output was then combined to produce the final constants.

In other words, Solinas’s hash-of-text theory was wrong. The constants were not the product of a deliberate encoding. They were the product of a casual randomness source whose output happened to land on valid curves.

Claude also identified the generation method for five additional curves listed in another NIST document and for four curves adopted through a separate NIST process. In some cases, it recovered how the base points — the public anchors used in key generation and signature verification — were selected.

Anthropic released code that reproduces the seeds. The findings can be verified by anyone with access to the standard and a C compiler.

Why this matters more than the math

The immediate practical impact is limited. The seeds are public parameters. They are not secret keys. No known attack exploits the fact that they came from lrand48. The curves themselves have not been shown to be weaker because of this discovery. If anything, the result reduces the probability that the NSA deliberately designed the seeds to hide a trapdoor. A deliberate backdoor would likely be more sophisticated than a timestamp-driven PRNG.

But the broader implications are harder to dismiss.

First, the timeline. Thirty minutes. A question that resisted human experts for twenty-five years was answered in half an hour by a system that has never read a single FIPS document and does not understand what a curve is. This is not a marginal improvement over previous methods. It is a structural shift in how fast open problems can be attacked when the attack surface is documentation, code, and published standards rather than encrypted traffic.

Second, the direction of the pressure. For years, the concern has been one-directional: the NSA builds systems; critics worry the systems are weakened. AI changes the geometry. If a model can reverse-engineer a generation process from final parameters, the same technique can be turned against other standards. The question is no longer whether a government agency hid something in a curve. It is whether any organization — commercial, academic, or state — can audit its own historical decisions the way Claude just did here.

Third, the trust recalibration. The crypto community has operated under the assumption that if a standard looks suspicious, we should remain suspicious until proven otherwise. That assumption is a rational response to limited transparency. Claude’s result shows that transparency can sometimes be restored faster than anyone expected — but also that the restoration process may not look like the one we planned. It may look like an AI model running experiments while humans sit back.

What remains unknown

Not everything was solved. Claude identified candidates for the seed generation that produced valid curves but were ultimately not selected. The reason those candidates were discarded is still unclear. The seed for the B-163 curve was not recovered. The selection method for base points in several curves remains unexplained. These gaps suggest that the full process may have involved more steps than the current findings reveal — or that the relevant records were lost and can never be reconstructed.

Anthropic’s team chose to donate the $12,288 bounty offered by Filippo Valsorda and others, which triples to $36,864 when directed to a qualifying charity. The money will go to the Internet Security Research Group, the nonprofit behind Let’s Encrypt. That is a clean signal. The result is not being held for leverage.

The next move

The cryptography community should treat this as a proof of concept, not a conclusion. Claude cracked one puzzle. The same approach may be applicable to other standards with undocumented generation methods — and there are many. The question now is not whether AI can solve these problems. It is who will direct that capability and what standards will emerge to govern its use.

For engineers and policymakers, the takeaway is practical: assume that any open-ended cryptographic question with enough documentation can be attacked by models like Claude within hours, not years. Audit your standards. Publish your generation processes. And do not rely on obscurity to protect your assumptions about what future tools can figure out.

The NSA did not plant a backdoor in these curves. But it also did not leave a receipt. Twenty-five years of doubt ended because an AI asked the right question and ran enough experiments to notice a pattern. That is not a comfort. It is a measurement of what comes next.