Mentioned in This Article
1. What did the AI find about the NIST curve seeds?
An Anthropic AI model has traced five previously unexplained seed numbers behind NIST elliptic curves to an ordinary random-number program fed with timestamps from 1997 and 1998, according to details published on October 17. The numbers were handed to the U.S. government by the National Security Agency in the late 1990s and had long been suspected of concealing a backdoor. The model needed under 30 minutes.
The result matters because the question had stayed open for roughly 25 years. Cryptographers, security researchers and engineers all tried to explain where the starting values came from, and none produced an answer that could be checked. The finding does not prove that nothing is hidden in the standard, but it removes the strongest reason for thinking something is.
2. Why does elliptic-curve cryptography depend on trust?
Much of the modern internet relies on elliptic-curve cryptography, and so do bitcoin wallets. The technique lets a person prove they control a secret key without ever revealing it. Every user holds a private key, but all of them depend on the underlying mathematical curve being genuinely hard to break.
A useful way to picture it is a lock whose design is published for anyone to inspect. People can examine the mechanism and test it, yet they still have to trust that its designers did not build in a flaw that only they know about. That is why the origin of the curve's parameters, and not only the arithmetic, has always mattered to security experts.
The central question, then, was simple to state and hard to settle: who chose the numbers that so many systems now treat as trustworthy, and how were they chosen?
Standards bodies exist partly to settle that kind of doubt. When an agency publishes a curve, outside experts expect to be able to follow the reasoning from the first input to the final parameters. A seed with no explanation breaks that chain, and even a harmless explanation, left unstated for decades, leaves room for suspicion to grow.
3. How did the NSA come to supply the numbers?
In 2000, the National Institute of Standards and Technology, the U.S. body that publishes widely used technical and cryptographic standards, adopted a set of curves that the NSA had supplied. The agency did not explain where some of the figures used to generate those curves had come from. The curves were published, the seeds were public, but the reasoning behind the seeds was missing.
That gap carried more weight after the disclosures made by Edward Snowden, which linked the NSA to efforts to weaken cryptographic standards. Against that background the silence was harder to wave away. NIST later dropped the Dual EC random-number generator from its recommendations, an episode that left a lasting impression on the field.
The seeds were starting numbers fed into a procedure that produces a curve. Because the NSA never said how it picked them, a theory took hold: the agency might have tried a huge number of alternatives and kept one with a weakness only it could exploit. In its most popular form, the theory describes a backdoor into every system built on those curves.
4. Who spent years trying to explain the seeds?
The mystery attracted serious scholarly attention. Cryptographers Neal Koblitz and Alfred Menezes examined it in a 2015 paper titled "A Riddle Wrapped in an Enigma." Menezes had helped write the original standard and recalled receiving the seeds in 1997 from Jerry Solinas, an NSA mathematician.
Security researcher Steve Weis spent years on the problem, including filing public-records requests in 2018. NIST replied that it had no documentation on the subject, and the NSA stopped responding. One lead suggested the numbers might have come from a humorous phrase that Solinas himself had since forgotten, which sent investigators off to test combinations of words.
In 2023, cryptography engineer Filippo Valsorda and other contributors put up a bounty of $12,288 for a solution. The reward would climb to more than $36,000 if the winner agreed to donate it to charity. Solinas died earlier that year, and the bounty produced no answer. For a time, the best witness to the original decision was no longer available to ask.
5. How did Claude trace the numbers?
This month, an Anthropic employee asked an internal research model to look into the puzzle. The employee did not pass along the forgotten-phrase theory, so the model approached the question without that hint.
A random-number generator is a routine that produces a long sequence of values from a starting point, and the same starting point always yields the same sequence. That repeatability is what made the search tractable: once the model identified the right generator, it could step through the candidates it produced and compare each one against the published seed until one matched exactly.
In under half an hour, the model linked five of the NIST seeds to lrand48, a random-number generator found in older C software libraries. It reproduced the sequence behind P-256, one of the most widely used of the NIST curves, and found an exact match for that curve's published seed at the 1,842nd candidate it generated.
The model's own commentary during the run was unusually candid. It briefly wondered whether it was inside a simulated test, then concluded that the result was real, noting that as far as it knew the bounty was still unclaimed. It described the outcome as "astonishing," saying it solved the 25-year-old mystery, and pointed out that the top bits of the match were all clear, a 20-bit pattern with about a one-in-a-million chance of occurring by accident. One line from the exchange has become the shorthand for the episode: "Wow, it's a real discovery."
6. Does this rule out an NSA backdoor?
Not entirely, but it makes one much less likely. Anyone can now rerun the program and arrive at the NSA's published numbers. Anthropic says this reduces the odds of a hidden weakness considerably, because the seeds appear to have come from a routine generator and a pair of dates rather than from a long, secret search for a flawed curve.
Some questions remain open. The team cannot yet explain why the program skipped certain usable candidates, nor how other parts of the curves were selected. Those loose ends are the reason the finding is described as making a backdoor less probable rather than impossible.
For people who use the NIST curves, the practical message is reassuring. Anthropic's guidance is that users need not change anything. The predictability that allowed the model to rebuild the numbers would be disastrous in a wallet, since anyone able to estimate when a key was created could recreate it and drain the funds. Here, though, the seeds were public from the start, so no secret was ever exposed.
The distinction matters for how the result should be read. A seed produced by an ordinary generator and plain timestamps looks like the output of a mundane process, not a deliberate hunt for a weak curve. It does not, however, prove the agency's intentions, which is why the unexplained details still draw interest from cryptographers.
7. Where does bitcoin fit in?
Bitcoin was never part of this dispute. Its wallets use a curve called secp256k1, which comes from a simpler equation than the NIST designs. That curve is defined by two small, fixed numbers with almost nothing left to adjust, so there is little room in which to hide a weakness.
By contrast, the P-256 curve includes a 77-digit number derived from the unexplained NSA seed. Cryptographers have pointed to bitcoin's simplicity as a point in its favor for exactly this reason.
Satoshi Nakamoto, bitcoin's pseudonymous creator, never publicly explained the choice of secp256k1. The curve saw little use before bitcoin made it famous. Ethereum later adopted it, and bitcoin kept it through its 2021 Taproot upgrade, which introduced a newer style of signature.
8. Is quantum computing still a threat to bitcoin?
Yes, and the new finding does nothing to change that. A sufficiently powerful quantum computer could work backward from a public key recorded on bitcoin's blockchain to the matching private key, regardless of how the curve was originally chosen. That risk is separate from the question of who picked the seeds, and it applies to bitcoin as much as to any other system built on elliptic curves.
Hardware is moving in that direction. Google said this week that its Willow chip cut errors about 40-fold in one of the costliest steps such a machine would need. Even so, no quantum computer is close to being large or reliable enough to crack a bitcoin key, and there is no clear timeline for when one might be.
The two stories therefore point in different directions. The seed mystery has largely been resolved in a way that supports confidence in existing standards, while the quantum question remains unresolved and continues to attract attention from the crypto industry.
Quantum risk and curve design are often discussed together because both concern whether the mathematics protecting funds can be trusted. They are different problems, though: one asks whether the curve was weakened on purpose, the other asks whether future machines can overpower any curve of this type.
9. What happens next?
Anyone can now run the program and retrace its path to the published numbers, which opens the finding to independent checking by cryptographers. That verification is the step that will determine how far the conclusion is accepted. The remaining unexplained details, including the skipped candidates and the selection of other curve elements, are likely to draw further study.
The $36,864 bounty will go to the Internet Security Research Group, the nonprofit behind Let's Encrypt, which provides free website security certificates. Directing the money there fits the charity condition attached to the larger version of the prize.