Claude Reveals NIST ECDSA Curve Origins: Unix Time and lrand48()

👤 1. Who Is Involved & Impacted?

• Discoverer & Verifier: Anthropic Research (Nicholas Carlini using an internal research snapshot of Claude) and Filippo Valsorda (@FiloSottile), creator of the $36,864 NIST Elliptic Curves Seeds Bounty (donated to Let's Encrypt / ISRG).
• Original Curve Authors: NSA mathematician Jerry Solinas and NIST, who standardized the five prime curves (P-192, P-224, P-256, P-384, P-521) in ANSI X9.62 and FIPS 186-2 (2000).
• Impacted Ecosystem: Virtually every TLS handshake, SSH key, JWT, and signed update relying on ECDSA P-256 / P-384.

📦 2. What Did Claude Discover?

For 25 years, lore from Koblitz & Menezes (2015) held that the five 160-bit (20-byte) NIST hex seeds were SHA-1 hashes of a forgotten English phrase ("Give Bob and Jerry a raise"). Claude solved the actual derivation in under 30 minutes:

1. The High-Bit Anomaly: Ignoring the English passphrase rumor, Claude inspected auxiliary X9.62 seeds and spotted that the most significant bit of every 32-bit word was always 0.
2. The lrand48() Fingerprint: That 31-bit non-negative output pattern matched lrand48() / drand48(), the 1990s POSIX C standard library linear congruential generator (LCG) with a 48-bit internal state.
3. Lattice Reduction (LLL) to 1997 Unix Time: Using lattice basis reduction, Claude reconstructed the full 48-bit state across five consecutive 32-bit outputs and stepped the generator backward to srand48(time(NULL))—landing on autumn 1997 Unix timestamps (e.g., P-256 at 871696354 = 1997-08-16 01:52:34 UTC).
4. Self-Doubt in the Trace: The solution was so simple that Claude paused in its reasoning trace to ask: "Wait... am I in some sort of simulated/test environment?"

📅 3. When & Where?

• When: Published on October 16, 2026, closing a mystery dating back to August–October 1997.
• Where: Detailed on Anthropic Research, verified by Filippo Valsorda, and discussed on Hacker News #50122800 (1,062 points, 390 comments).

🎯 4. Why Does This Deflate the NSA Seed-Rigging Theory?

• At Most ~30 Bits of Freedom (~10^9 Curves): Even if the NSA tested every second of 1997 and picked among the first 16 viable candidates (accounting for an ~50% skip rate, likely an order check $n \le p$), Filippo Valsorda showed this leaves barely ~30 bits of selection freedom.
• Too Small to Hide a Backdoor: As shown in Bernstein & Lange's BADA55 paper, grinding for a secret mathematical weakness requires $2^{61}$ to $2^{70}$ trials—unless 1 in every billion prime curves belonged to an undiscovered weak class that academic cryptographers missed for 30 years.

⚙️ 5. Technical Summary & Community Reaction

• 13 Years of Tinfoil Hats (@sweis, @tptacek): Security researcher Steve Weis (@sweis), who originally investigated the passphrase rumor, summed up the saga: "13 years of tinfoil hats for srand48(time(NULL)."
• Internal vs. Public Model Moat (@slowin — 110+ replies): Public Claude failed when given the exact same prompt, sparking debate over the growing capability gap between internal lab checkpoints and public releases.
• Cleared Right Before Retirement: Commenters noted the irony that NIST P-curves were finally exonerated just as the industry begins migrating toward post-quantum signatures (ML-DSA).

✅ CONCLUSION

A quarter-century of NSA backdoor suspicion over the NIST P-curve seeds boiled down to a 1990s programmer calling srand48(time(NULL)), leaving at most ~30 bits of selection freedom and proving how frontier AI plus lattice math can crack cold-case cryptographic mysteries in minutes.

References

• Anthropic Research — Claude reveals ECDSA curve origins
• Filippo Valsorda — The NIST Elliptic Curves Seeds Bounty Has Been Claimed
• Koblitz & Menezes (2015) — A Riddle Wrapped in an Enigma (IACR ePrint 2015/1018)
• Hacker News Discussion (1,062 points, 390 comments)