Key takeaways
- Anthropic says an internal Claude model traced five NIST curve seeds to the lrand48 random-number generator.
- Anthropic calls the finding no cryptographic break and says it makes a hidden backdoor much less plausible.
- Bitcoin uses secp256k1, not a NIST curve, so the seed discovery leaves Bitcoin's security assumptions unchanged.
Anthropic reports that an internal Claude research model traced the NSA-supplied seeds of five NIST elliptic curves to the C library's lrand48 random-number generator, cracking a puzzle that had stood for 25 years. In under half an hour, Claude found that the seeds of the NIST P-192, P-224, P-256, P-384 and P-521 curves came not from any hash algorithm but from lrand48, seeded with Unix timestamps.
Anthropic said the finding is not a cryptographic break, new attack, or weakness in the ECDSA curves. Anthropic said it is now more confident the curves were chosen without any backdoors or intentional weaknesses, and that there is no action for users to take.
A Random Number Generator, Not a Hidden Hash
Suspicion of the NIST curves was tied to their unexplained seeds and to the NSA's Dual EC random number generator. Anthropic's write-up put the answer plainly:
"In under half an hour, Claude discovered the origins of the NIST P-192, P-224, P-256, P-384, and P-521 seeds. None of them were the results of any hash algorithm at all, but rather the output of the C library's lrand48 random-number generator, seeded with a Unix timestamp!"
Anthropic says a hidden backdoor is much less plausible, not impossible. Open questions remain: Anthropic cannot explain why some usable candidates were skipped, the base points of P-224, P-256, P-384 and P-521 are unexplained, and the binary-curve seed B-163 is unexplained.
Bitcoin Never Used These Curves
Bitcoin uses secp256k1, not a NIST curve. Bitcoin's wallets run on secp256k1, a curve built from a simpler equation, which leaves little room for anyone to have quietly built a weakness into bitcoin's curve. The discovery does not reveal a vulnerability in Bitcoin's cryptography or change its security assumptions.
Satoshi Nakamoto never publicly explained why he picked secp256k1. Sufficiently powerful quantum computers could eventually pose a separate threat to secp256k1, and the seed discovery says nothing either way about that risk.
Why It Matters
Bitcoin never relied on the NIST curves, because Bitcoin uses secp256k1 and its simple equation has no opaque seeds, so Bitcoin's security assumptions are unchanged by the seed discovery. We think that guts the claim that the NSA built Bitcoin's cryptography, since the NIST curve seeds now have an ordinary explanation and Bitcoin's curve was never part of that case, which makes the idea that US government agencies created Bitcoin less and less plausible. The real lesson is verification: secp256k1 leaves little room for anyone to quietly build in a weakness, so Bitcoiners can verify the math without trusting the agency that picked the constants. Standards handed down by the state ask for faith, while open-source hard money asks only that you check.
