The suspicion lasted 25 years. The answer took half an hour.
In 2000, NIST adopted the elliptic-curve ECDSA standard, the world’s most used cryptographic signing standard. Each curve came with a parameter called a seed, supplied by the NSA, with no explanation. Twenty-five years of speculation about whether those numbers hid a backdoor.
The rumor and the hypothesis
The strongest rumor was Jerry Solinas’s, a veteran agency official: he had reportedly generated the seeds from the hash of a funny phrase he forgot, and died in 2023 without recalling it. A bounty was announced and nobody won.
In October, an Anthropic employee asked the internal research model whether it could solve it without the rumor’s clue. Claude found the seeds of P-192, P-224, P-256, P-384, and P-521 in under half an hour.
The answer: a clock, not a conspiracy
The result is not what the rumor claimed. The seeds are not the hash of any phrase: they are the output of the C library’s lrand48 random generator, seeded with a Unix timestamp. A clock, not a funny phrase.
The method is what is worth reading. Instead of trying the rumor’s phrase, Claude anticipated how 1997 software must have worked: a weak pseudorandom generator, the kind recognizable by its output. The model wrote a scanner sweeping every published seed bit by bit and tested 34 generator and output-slice combinations.
The signature appeared in four of the ten seeds: the highest bit was zero in all twenty words, a 1-in-5,810 probability that signed lrand48, which returns only 31 of its 48 state bits. Recovering the truncated state is a classic lattice problem, solved with the LLL algorithm.
The security implication is good
The curves were not poisoned. The technique described by Daniel Bernstein and Tanja Lange, which could have exploited the seed-choice freedom, was completely ruled out: even with total freedom over timestamps and candidates, about 30 bits remained, insufficient to target a weak curve class or embed a backdoor.
And the symbolic ending: Filippo Valsorda, the cryptographer who organized the three-year bounty and historically defends the alternative curves, published that he now personally recommends the NIST curves over his own. He closed with the sentence nobody expected: exactly the timing for them to be retired in favor of post-quantum signatures.
The lesson that is not technical
It is about trust. Twenty-five years of speculation eroded trust in a system we now know is clean, and nobody needed to change anything: it just needed computing.
It is the same pattern as the Astra Enigma case: decades of accumulated suspicion, a finite search space, a method anticipating the system’s historical context, and community validation. AI became the instrument that closes processes hope and paranoia kept open.
Conclusion
Twenty-five years of theory, half an hour of scanner, and the answer was a clock.
For cryptography operators, the case cleans an old stain with the best possible outcome: nothing to fix, everything to document. For AI operators, it is further proof of the year’s thesis: suspicion turned into a testable hypothesis with a finite search space is the kind of problem AI closes. And it closes fast.