The lede
Claude reveals ECDSA curve origins
Anthropic · made the Sunday
For twenty-six years the NIST elliptic curves that secure most of the internet have rested on seed values the NSA handed over without explanation, which is the single most-cited reason to suspect a backdoor; the one insider who knew died in 2023 and a standing bounty went unclaimed. An internal Anthropic research model, given the problem cold, took under half an hour: rather than hunt for the hash everyone assumed was behind the seeds, it guessed the numbers were output from a weak PRNG of the era, noticed that the top bit of every 32-bit word was zero across four seeds — a 1-in-5,810 coincidence and the fingerprint of `lrand48` — brute-forced the hidden state for the binary curves, and recovered it for the prime curves with LLL lattice reduction. Trace the recovered states back through `srand48` and you get Unix timestamps from 1997 and 1998: somebody ran a program in a loop until the curve came out valid, and P-256 was candidate 1,842. The post ships Python that reproduces the published values, and is honest about the loose ends — B-163 and most of the base points are still unexplained, and the program skipped some perfectly valid candidates for reasons nobody knows. Nothing here breaks ECDSA. What it does is turn the field's central conspiracy hypothesis into a much duller and more plausible story about a guy, a timestamp, and a while loop, and it is the clearest public example yet of a model doing the kind of work that had defeated people who wanted the answer badly.