For twenty-five years the number sat in a federal standard without an explanation: SEED = C49D3608 86E70493 6A6678E1 139D26B7 819F7E90. From that value, by a procedure published in 2000, the parameters of the P-256 elliptic curve are derived, and P-256 is the curve behind a large share of the encrypted traffic on the web.
The story inside the National Security Agency was that Jerry Solinas, a mathematician who spent his career there, had generated the seeds by hashing an English sentence, something on the order of “Give Bob and Jerry a raise.” Solinas said as much in a 2015 email, adding that he could not recall the phrase and that the archives were probably gone. He died in 2023.
On Thursday, Anthropic’s Frontier Red Team said an internal research model had answered the question in under half an hour. The seeds were not hashes of anything. They were the output of lrand48, the 48-bit generator that shipped with 1990s C libraries, initialized with a Unix timestamp.
The timestamps fall between May 1997 and April 1998. The P-256 seed corresponds to Aug. 16, 1997, at 01:52:34, and was the 1,842nd candidate the generator produced that was accepted. The same method accounts for P-192, P-224, P-384 and P-521.
Why anyone outside a seminar room cares is a matter of provenance. In the standard, FIPS 186-2, each curve is published with a seed, and the coefficient b is defined as the hash of that seed. The design lets a reader verify that the curve was not cooked: given the seed, anyone can recompute the parameters and check that they match.
What the design does not do is explain where the seed came from. A seed chosen at random and a seed searched for until it produced a curve with a hidden property look identical in the published document.
That gap became politically charged in 2013, when documents disclosed by Edward Snowden showed the agency had promoted a random number generator, Dual_EC_DRBG, that contained a backdoor its author could use. NIST withdrew the generator. Cryptographers Neal Koblitz and Alfred Menezes wrote a long paper in 2015 titled “A Riddle Wrapped in an Enigma” that laid out the suspicion and the absence of evidence, and the question stayed open long enough to attract a public bounty.
How the model got there is the part that reads like engineering rather than mathematics. Searches built from the rumor had failed. Claude took a different angle: it reasoned about what software in 1997 would have looked like and guessed a generator from the era’s C libraries. It wrote a scanner that slid along each published seed one bit at a time, testing whether adjacent chunks were consecutive outputs of such a generator, across 34 combinations of generator and slice.
Then it noticed that in four of the ten seeds, the top bit of all twenty 32-bit words was zero. The chance of that is about one in 5,810. That pattern is the signature of lrand48, which returns the top 31 bits of a 48-bit state. From there the state could be recovered by trying all 2^17 values of the seventeen bits the output hides.
Filippo Valsorda, the cryptographer who posted the bounty three years ago, reimplemented the algorithm in Go and confirmed it. The bounty was claimed on Oct. 15 at 01:07:51 UTC and donated to the Internet Security Research Group, which operates Let’s Encrypt, at triple its value, or $36,864.
Anthropic was careful about what the result means. The company said the finding is not a cryptographic break, not a new attack and not a weakness in the curves. It argued the opposite: a seed produced by a clock and a stock generator is a seed nobody could have steered, which makes a deliberate backdoor much less plausible. The research note ends with the sentence a security team wants to write, that there is no action to take and nothing to change.
Some questions remain. The seed for B-163, a curve over a binary field, and the base points for several curves are still unexplained. Valsorda’s writeup notes two rejection criteria that were applied beyond the published procedure, one of which he could characterize and one he could not, leaving roughly twice as many valid seeds as were eventually standardized. A reconstruction that explains most of the record is not the same as the source code.
Cryptographers who reviewed the work said the more interesting precedent is the method. A model was pointed at a question with no searchable answer and produced a hypothesis about a 1997 build environment, then a scanner, then an arithmetic recovery, in the time it takes to read a paper. The output is checkable by anyone with a compiler, which is what separates a result from a claim.
The standard itself has not changed. The curves are the same curves, the signatures are the same signatures, and the certificates in a browser’s store will validate tomorrow as they did yesterday. What changed is the argument available to anyone who has to explain why an unexplained constant should be trusted.
For Solinas, the answer arrived three years too late to be confirmed by the person who wrote the code. The sentence he half-remembered was never hashed. The seed was a clock reading on an August night in 1997, taken by a program that had no idea what it was starting.
