Cryptographers spent 25 years trying to work out where a few numbers came from after the NSA gave them to the U.S. government. An Anthropic research model found the answer in under 30 minutes. The explanation is far duller than the conspiracy theories. The numbers came from an ordinary random-number program that was fed timestamps from 1997 and 1998.
For anyone who feared a backdoor, that is reassuring. Anthropic admits, however, that the finding leaves some questions open.
Years of dead ends
Earlier this month, an Anthropic employee gave the problem to an internal research model. The employee left out the theory that had kept human investigators going in circles. That theory held that the seeds came from a humorous phrase that NSA mathematician Jerry Solinas later forgot.
Leaving it out turned out to matter. Because the phrase idea wasn’t in its context, the model looked elsewhere. It linked five NIST curve seeds to lrand48, a random-number generator that ships with older C software libraries.
The model then rebuilt the sequence behind P-256, one of the most widely used curves. At the 1,842nd candidate, it got an exact match with the published seed.
A moment of suspicion: was this a test?
The model’s recorded reasoning is the oddest part of the story. Before it accepted its own result, it asked itself whether it might be inside a simulated test.
“This is astonishing: it solves the 25-year-old mystery,” the model wrote. Then it checked itself: “Hmm, is it plausible in reality? As of my knowledge … the bounty was unsolved.” It noted that all 20 top bits were clear, which has a one-in-a-million chance of happening, and concluded: “So indeed real-world.”
The model was weighing how likely a coincidence was, which is the first thing a skeptical human would check. It deserves credit for that.
Why a handful of seeds mattered
Much of the internet depends on elliptic-curve cryptography, the same branch of math that protects bitcoin wallets. It lets someone prove they hold a secret key without revealing anything about the key.
One way to picture a curve is as a lock design that anyone can examine. Each user has their own private key, but every one of those keys relies on the design being hard to break.
In 2000, the U.S. National Institute of Standards and Technology (NIST) adopted a set of curves provided by the National Security Agency. The starting values, known as seeds, were public. The NSA never explained how it chose them.
The concern was straightforward. If the agency had tried seed after seed until one produced a curve with a flaw only it knew about, it would hold a key to every system using that curve. The tinfoil-hat version of the theory claimed exactly that.
Snowden made the doubts harder to ignore
The NSA’s silence looked worse after the Snowden disclosures connected the agency to efforts to weaken cryptographic standards. NIST later dropped one of those tools, the Dual EC random-number generator, from its recommendations.
Cryptographers Neal Koblitz and Alfred Menezes tackled the controversy in a 2015 paper titled “A Riddle Wrapped in an Enigma.” Menezes had helped write the original standard and remembered receiving the seeds from Solinas in 1997.
Security researcher Steve Weis worked on the question for years, including public-records requests he filed in 2018. NIST said it had no documentation, and the NSA stopped responding.
In 2023, cryptography engineer Filippo Valsorda and other contributors offered a $12,288 bounty. It would rise to over $36,000 if the winner gave it to charity. Solinas died earlier that year, so researchers had only old recollections and the numbers themselves to work with. Neither led anywhere.
What’s settled and what remains open
Anyone can now run the program again and get the exact numbers the NSA supplied. Anthropic said this makes a hidden weakness much less likely.
The team still can’t explain why the program passed over some usable candidates, or how other parts of the curves were chosen. Showing that the seeds came from a deterministic process answers one question well, but it is not a full audit.
In its blog, Anthropic said people using the NIST curves don’t need to change anything.
In a crypto wallet, the same method would be a disaster
Claude could rebuild the seeds because the generator is predictable. In a wallet, that predictability would be catastrophic. Anyone who worked out roughly when an lrand48-generated secret key was created could recreate it and drain the funds.
The NSA’s seeds were public from the start, so there was never a secret here to steal.
Bitcoin was never part of this puzzle. Its wallets use secp256k1, a curve built from a simpler equation defined by two small, fixed numbers that leave almost nothing to adjust. P-256’s equation includes a 77-digit number that came from the NSA’s unexplained seed.
With so few settings to change, there is little room to hide a weakness in bitcoin’s curve, and cryptographers have long counted that in its favor. Satoshi Nakamoto never publicly explained why they chose it, and the curve saw little use before bitcoin made it famous. Ethereum adopted it later, and bitcoin kept it when the 2021 Taproot upgrade introduced a newer style of signature.
Quantum computing is still an open threat
A powerful quantum computer would be a different kind of risk. It could work backward from a public key visible on Bitcoin’s blockchain to the secret key behind it, however the curve was chosen.
The hardware keeps getting closer. Google said this week that its Willow chip cut errors about 40-fold in one of the most expensive steps such a machine would need.
Even so, nobody has built a quantum computer anywhere near large or reliable enough to break a bitcoin key, and there is no clear timeline for when one might arrive.
The $36,864 bounty is going to the Internet Security Research Group, the nonprofit behind Let’s Encrypt, which gives websites free security certificates. Money raised over a suspected NSA backdoor will end up funding free encryption on the web.