Claude traces five ECDSA curve seeds to timestamps

Anthropic says Claude traced five public curve seeds used in the Elliptic Curve Digital Signature Algorithm (ECDSA) to an old C-library pseudorandom generator initialized with timestamps. Published on October 16, the research describes no new attack or exposed private keys. Users do not need to patch software, change passwords or rotate signing keys in response.

Why the public seeds raised questions

Digital signatures help verify who signed data and whether it has been altered. ECDSA uses shared mathematical parameters, including an elliptic curve.

NIST adopted these curves in the 2000 FIPS 186-2 standard. Their public seed values, supplied by the NSA, helped define the curves, but their origins were not explained. That omission fueled suspicions that the parameters might have been deliberately chosen to contain hidden weaknesses.

These are public curve-generation seeds, not private signing keys or the secret per-signature values called nonces. Reproducing them does not reveal those secrets. The historical use of a weak generator for public parameters does not make it suitable for generating private keys.

Replaying a 1990s generator

According to Anthropic, an internal research model of Claude found the origins of the NIST P-192, P-224, P-256, P-384 and P-521 seeds in under half an hour after an employee’s prompt. That is the company’s account of this discovery, rather than a timing claim for the entire research project.

Claude investigated how 1990s C software might have produced the values. It searched for recognizable output patterns, recovered the pseudorandom generator’s internal state and reproduced the published seeds. The generator was lrand48, initialized with Unix timestamps—numbers representing time.

Five ANSI example-curve seeds matched the same generator pattern. The result provides a reproducible explanation for those historical public values.

B-163 and several base points remain unexplained

The team also traced the base points for P-192 and five ANSI example curves to the generator in the FreeLIP arithmetic library. A base point is a separate fixed point used to derive public keys; the curve seed alone does not determine it.

The B-163 seed remains unexplained, as do the base-point origins for P-224, P-256, P-384 and P-521 and the NIST binary curves. The researchers also found that some apparently viable candidate curves had been skipped, but do not know what selection criteria were used.

Anthropic argues that the simple, reproducible seed origins make deliberate backdoors less plausible. That assessment strengthens its confidence in the curves without proving that every parameter is free of intentional weaknesses. The published research includes code and outputs for readers who want to follow the reconstruction.