Claude Traces Five NIST Curve Seeds to a Timestamped 1990s Generator

Anthropic’s Claude traced the seed values for five prime curves standardized by the National Institute of Standards and Technology (NIST) to a timestamp-based random-number generator, showing how the five seeds were generated without demonstrating a break or new weakness in ECDSA.

The curves are P-192, P-224, P-256, P-384 and P-521. Their published seeds matched 20-byte candidate values produced by lrand48, a C-library pseudorandom generator initialized with Unix timestamps.

For P-256, the matching value was candidate 1,842 in a run that began Aug. 15, 1997, at 9:52:34 p.m. ET (Aug. 16 at 1:52:34 a.m. UTC). The timestamps associated with the other four prime-curve seeds fell between May 1997 and April 1998. The search took less than 30 minutes.

The analysis tested combinations of random-number generators and output slices. A clue was that several seeds had their highest bits clear, consistent with lrand48, which outputs 31 bits from a 48-bit internal state.

Claude also traced the base points for six curves to FreeLIP’s random-number generator: P-192 and five ANSI X9.62 example curves. The process used small integer seeds, discarded seven outputs, then generated candidate x-coordinates from 26-bit outputs reduced modulo the curve’s prime. It repeated the process until an x-coordinate produced a point on the curve.

For four binary-curve initializations, direct timestamp conversion pointed to February 1984. Doubling the recovered values instead placed them on April 17, 1998, suggesting the software may have halved the clock value. The fifth binary-curve seed, B-163, remains unexplained.

The base points for P-224, P-256, P-384, P-521 and the NIST binary curves also remain unresolved. P-256 had another potentially viable candidate, numbered 876. Whether any criteria guided the selection among candidates is unknown. The $36,864 seed-discovery bounty is earmarked for the Internet Security Research Group.