Unmasking the Origins of ECDSA Curves: A Revelation by Claude

Date: October 16, 2026 Source: Anthropic

The cryptographic community has long been haunted by a decades-old enigma regarding the origins of one of its most fundamental standards. That mystery—once a source of deep suspicion—has finally been solved. It turns out the answer was surprisingly mundane: “It’s just timestamps.”

The Long-Standing Cryptographic Riddle

The Elliptic Curve Digital Signature Algorithm (ECDSA) stands as the most prevalent standard for elliptic curve cryptography. In the year 2000, NIST integrated it into the FIPS 186-2 Digital Signature Standard, which defined several standard curves tailored for different security tiers and sizes.

For curves utilizing binary or prime fields, the specifications included a "seed" parameter. The hash of this seed is what determines the curve's coefficient $b$. However, the NSA provided these seeds without any accompanying documentation or justification, leading to widespread skepticism.

The P-256 Example

To illustrate, the seed for the NIST P-256 curve was simply listed as: SEED = C49D3608 86E70493 6A6678E1 139D26B7 819F7E90

With no explanation of its provenance, researchers like Alfred Menezes and Neal Koblitz detailed the resulting controversy in their paper, "A Riddle Wrapped in an Enigma." This lack of transparency sparked amateur investigations and even financial bounties for anyone who could crack the code.

The "Humorous Passphrase" Theory

For years, the most compelling theory was that Jerry Solinas, a veteran of the NSA, had generated the seeds by hashing a joke.

"I believe there was a counter rather than multiple hashing, but I don’t know details. The message was along the lines of ‘Give Bob and Jerry a raise’ or ‘Bob and Jerry rule’ or something like that. It was Bob Reiter who actually wrote the code, and he doesn’t remember the details either. If they exist, they are no doubt sitting on a hard drive near the Ark of the Covenant." — Jerry Solinas, 2015

Tragically, Jerry Solinas passed away in 2023, and other former colleagues remained silent, leaving the "humorous phrase" theory as an unverified legend.

How Claude Cracked the Case

Several Anthropic staff members had previously tried to find the seeds by guessing phrases, but they failed. In October 2026, an employee posed a challenge to an internal research model: figure out the seed generation method without being given the "humorous phrase" clue.

In less than 30 minutes, Claude identified the origin of the seeds for the following curves:

• P-192
• P-224
• P-256
• P-384
• P-521

The Discovery: Not a Hash, but a Clock

Claude revealed that the seeds were not the result of any cryptographic hash function. Instead, they were generated using the lrand48 random-number generator from the standard C library, initialized with a Unix timestamp ($t$).

The process worked as follows:

1. Initialize the RNG with a timestamp $t$.
2. Sample bytes for $n$ iterations.
3. The first 20 bytes become Candidate 1, the next 20 become Candidate 2, and so on.

For the P-256 curve, this process required $n = 1,842$ iterations to produce the final standardized seed.

Comparison of Theories

The Technical Deep Dive

Claude didn't find the answer by guessing words, but by analyzing the mathematical signature of the output.

The Investigation Workflow

The Mathematical Process

1. Pattern Recognition: Claude noticed that in several seeds, the top bits were all zero. Specifically, four out of ten seeds had a $0$ in the top bit across all 20 words (when viewed as 32-bit words).
2. Identifying the Generator: This is a hallmark of lrand48, which only outputs the top 31 bits of a 48-bit internal state.
3. State Recovery: To find the hidden bits, Claude took the first word and tested all $2^{17}$ possible values for the missing bits to see if the subsequent words matched.
4. Lattice Reduction: For prime-curve seeds where the output was truncated, Claude utilized the Lenstra–Lenstra–Lovász (LLL) basis reduction algorithm—a textbook method for solving lattice problems—to recover the state of a truncated linear congruential generator.
5. Reversing the Clock: Since lrand48 is reversible, Claude stepped the state backward until it matched the form of an srand48 initialization, specifically where the low 16 bits equal 0x330E.

Implementation Logic

// Conceptual logic of the discovery
void recover_seed(uint64_t seed_val) {
    // 1. Identify lrand48 signature
    // 2. Use LLL to recover 48-bit state from truncated bits
    // 3. Step backward: state = (state - offset) % modulus
    // 4. Check if (state & 0xFFFF) == 0x330E
}

Final Implications

This discovery is not a security vulnerability or a "break" of ECDSA. On the contrary, it provides significant peace of mind.

The Verdict:

• Eliminate suspicion of intentional backdoors.
• Confirm parameters were chosen via a simple, reproducible PRNG.
• Close a decades-old mystery.

By proving that the seeds were generated by a common, non-cryptographic generator initialized by a system clock, the possibility of "subversion" is virtually eliminated. We can now be confident that these parameters are secure.

Figure 1: Conceptual representation of the NIST P-256 curve now known to be derived from a simple Unix timestamp.