Inside the 2000 standard FIPS 186-2 sits a string of numbers that anchors one of the most widely used curves in the world: the P-256 seed, C49D3608 86E70493 6A6678E1 139D26B7 819F7E90. For years the accepted explanation was a half-remembered joke phrase, and a bounty for a better answer went unclaimed. On 16 October 2026 Anthropic’s Frontier Red Team reported that an internal Claude research model had found the real one in under half an hour. Each seed is the output of the C library’s lrand48 generator, started from a Unix timestamp from 1997 or 1998.
Anthropic is explicit about what this is not. It is not a cryptographic break, not a new attack, and not a weakness in the ECDSA curves. There is no action to take. I reran the code myself on 25 October 2026, and this note explains what was found, why it leaves your systems alone, and what it teaches about working with AI.
The seeds in numbers
- < 30 minfor an AI model to trace the seeds to a clock readingAnthropic, 16 Oct 2026
- 1 in 5,810chance of the zero-top-bit pattern appearing by luckAnthropic
- 1,842the candidate number behind the published P-256 seedReproduced, 25 Oct 2026
- ~30 bitsof freedom a clock reading leaves, against 160 for a free seedValsorda; Bernstein and Lange
What a Curve Seed Is
01 · Why anyone cared
A seed that proves the curve was not hand-picked
The NIST curves were described as “verifiably random.” The idea is simple: instead of choosing curve parameters by hand, the designers started from a seed, expanded it with SHA-1, and let the output decide the curve. Anyone can repeat the expansion and check the curve follows from the seed. The seed is the single input that fixes everything else.
The catch is that a hash makes the seed all-or-nothing. Flip one bit of the seed and the curve changes completely; in one bit-flip example the derived value c differed in 118 of 256 bits. That is the point of the design, and it is also why the question “where did the seed come from?” mattered. The seed is checkable, but its origin was not. Alfred Menezes received the seeds from Jerry Solinas in fall 1997, and in 2014 Bernstein and colleagues raised the worry that a backdoor could be hidden in how such seeds were chosen.
The Story Everyone Believed
02 · An unconfirmed account
A joke phrase, and nobody left to ask
In 2015 Solinas gave an account: the seed came from a phrase along the lines of “Give Bob and Jerry a raise.” Bob Reiter wrote the code and did not remember the details. Solinas died in early 2023. The phrase could never be confirmed, and trying to reverse it by guessing wording was a dead end.
In October 2023 Filippo Valsorda put up a bounty of $12,288, tripled if donated. It stood for three years.
What the Model Tried Instead
03 · A new question
Not “what phrase?” but “what software?”
The model dropped the phrase search. It asked a different question: what software would have produced numbers like these in 1997? Its guess was a weak random-number generator from a 1990s C library, lrand48.
That guess leaves a fingerprint. lrand48 returns 31 bits, so a 32-bit word built from its output starts with a zero. The seeds showed that pattern, which would turn up by chance about once in 5,810 times, by Anthropic’s figure. With the generator identified, the rest was recovery: work back to the hidden state, then to the starting value. For P-256 the run began on 16 August 1997 at 01:52:34 UTC, and the published seed is candidate 1,842. A valid candidate, 876, was skipped.
The breakthrough was a better question, not a bigger search.
How It Was Checked
04 · Reproduced, not just reported
Fifteen curves, each rebuilt from a clock reading
The claim covers ten prime-curve seeds and five ANSI X9.62 example curves. Each one is regenerated from a timestamp and a small candidate number. The model’s own notes were candid about the setting; one asked, “am I in some sort of simulated/test environment?” and another recorded, “It’s verified by direct computation on my side.”
Verification did not stop with the model. Anthropic published the code under CC0, and Valsorda re-implemented it in Go. The bounty was claimed on 15 October 2026, donated to ISRG (the Let’s Encrypt nonprofit), and tripled to 36,864 dollars. On 25 October 2026 I reran the code: all nine published seeds match FIPS 186-2, five prime curves and four binary curves. Skipped candidate 876 is not in the standard, as expected.
What It Means for Your Systems
05 · Nothing to change
No key to rotate, no curve to replace
Nothing to change, nothing to rotate, no curve to replace. The finding is about history, not about the strength of the curves in use today. It does, however, speak to the old backdoor worry. Valsorda says a clock reading leaves “barely 30 bits of freedom,” and that the findings “completely rule out the technique described by Bernstein and Lange.” Anthropic calls a deliberate backdoor “much less plausible.”
The arithmetic is plain. A free seed has 160 bits of room to hide something. The 2017 Bernstein and Lange technique needs about 70. A clock reading leaves about 30, roughly 40 bits less than that technique requires.
Still open
- Skipped candidates. Some valid candidates were passed over, including 876 for P-256. Valsorda found one extra rejection rule; another is still unexplained.
- B-163. Its seed fits nothing the model tried.
- Base points. The base points of P-224, P-256, P-384 and P-521 remain unexplained, though the model did explain six May 1997 curves, including P-192.
The Timeline
06 · From a clock to a standard to a check
Twenty-nine years in ten entries
- 1997–98
Clock seeds May 1997 to Apr 1998
The seeds are produced from clock readings.
- 1997
Handed over Fall
Solinas gives the seeds to Menezes.
- 2000
FIPS 186-2 Standard
The seeds are published in the standard.
- 2014
The concern Bernstein et al.
A backdoor worry is raised in print.
- 2015
The phrase Recalled
Solinas recalls a phrase along the lines of “Give Bob and Jerry a raise.”
- 2017
A technique Bernstein and Lange
It needs about 70 bits of freedom.
- 2023
Solinas dies Early 2023
The one person who could say is gone.
- 2023
Bounty offered 5 Oct 2023
Valsorda offers $12,288, tripled if donated.
- 2026
Bounty claimed 15 Oct 2026
The answer is found and the bounty claimed.
- 2026
Write-up and rerun 16 and 25 Oct 2026
Anthropic publishes its findings on 16 October; the code is reproduced on 25 October.
What It Shows About Working with AI
07 · The practice worth copying
Ask for steps you can rerun, not just answers
The model got there by letting go of a story nobody could confirm and turning a new idea into steps that could be checked. People then reran and re-implemented the code, and listed plainly what remained unexplained. That is a method any team can borrow: when an AI model hands you a conclusion, ask for the reproducible claim and the steps behind it, then have someone else run them.
An answer you cannot rerun is an opinion. One you can rerun is evidence.
Ask your AI for claims you can check
Whatever the model produces, ask for the steps that let a second person reproduce it. The same habit makes AI-written code reviewable; see how, and how a team can carry it into daily work.
Sources
- https://www.anthropic.com/research/ecdsa-curve-origins,Anthropic Frontier Red Team, “The origins of the NIST ECDSA curve seeds”, 16 October 2026
- https://saweis.net/posts/nist-curve-seed-origins.html,Steve Weis, on the NIST curve seed origins
- https://eprint.iacr.org/2014/571,Bernstein, Chou, Chuengsatiansup et al. (2014)
- https://words.filippo.io/dispatches/seeds-bounty/,Filippo Valsorda, the seeds bounty
- https://words.filippo.io/seeds-solved/,Filippo Valsorda, the seeds solved
- https://csrc.nist.gov/files/pubs/fips/186-2/final/docs/fips186-2.pdf,FIPS 186-2 (2000)