Claude AI Cracks the NSA’s 25-Year Cryptography Seed Mystery

For decades, some of the world’s brightest cryptographers had been chasing a ghost. Five mathematical curves used to protect internet communications carried mysterious numbers supplied by the National Security Agency (NSA), and nobody could satisfactorily explain where those numbers came from. Theories ranged from forgotten jokes to deliberately planted weaknesses. Then Anthropic’s Claude AI took a crack at the puzzle and traced the numbers to an old computer program and timestamps dating back nearly three decades.

A 25-Year Mystery With the NSA at Its Center

The story begins in the late 1990s, when mathematicians were developing standards for elliptic curve cryptography, a method of protecting digital information using sophisticated mathematics. Five curves, known as P-192, P-224, P-256, P-384 and P-521, eventually became part of standards published by the National Institute of Standards and Technology (NIST). Their mathematics helped secure websites, financial transactions and government communications.

But here’s the kicker. Each curve had been constructed using a mysterious 160-bit starting number called a seed. Anyone could verify the mathematical procedure used to produce the curves, but nobody knew how the NSA had chosen those original numbers. That unanswered question fueled speculation that the agency might have deliberately selected seeds to conceal a weakness only its own specialists could exploit.

Cryptographers Neal Koblitz and Alfred Menezes examined the controversy in their 2015 paper, “A Riddle Wrapped in an Enigma.” No practical backdoor was ever demonstrated, but the mystery refused to die.

The Secret Phrase That Apparently Never Existed

For years, the prevailing explanation involved NSA mathematician Jerry Solinas, who reportedly supplied the original seeds. Solinas and others recalled that the numbers had been generated by hashing humorous English phrases, possibly something resembling “Jerry deserves a raise.” Hashing converts information into a fixed-length mathematical fingerprint. Unfortunately, nobody remembered the exact phrases, and the original computer had reportedly been replaced.

Solinas himself tried reconstructing the process without success. The mystery eventually acquired a price tag. In October 2023, cryptographer Filippo Valsorda offered a $12,288 bounty for anyone who could explain the seeds’ origins. A charitable matching arrangement brought the potential payout to $36,864. For three years, the money went unclaimed. Then Claude entered the picture.

Claude Finds the Answer Hiding in Plain Sight

According to Anthropic’s research published Oct. 16, an employee asked an internal Claude research model to investigate the seeds without mentioning the longstanding secret-phrase theory. The model began examining patterns associated with older computer programs. One clue immediately stood out. Several seeds contained groups of numbers whose highest bits were consistently zero, a pattern with roughly a 1-in-5,810 chance of appearing randomly.

That pointed toward lrand48, a pseudorandom number generator commonly available in Unix-era programming environments. Unlike genuinely random processes, pseudorandom generators produce predictable sequences once their starting values are known. Claude worked backward through the mathematics, recovered the generator’s internal states and reproduced the published seeds exactly. Then came the real humdinger.

The starting values corresponded to Unix timestamps, ordinary numerical representations of dates and times, from 1997 and 1998. The model’s recorded reasoning captured its own apparent disbelief. “This is astonishing: it solves the 25-year-old mystery.” The whole business took less than 30 minutes.

Five Curves, Five Timestamps and One Extraordinary Match

The recovered starting values traced the five NIST prime-field curves to specific dates between May 1997 and April 1998. P-192 originated from a timestamp corresponding to May 18, 1997, while P-521 traced to Aug. 8 of that year. P-256 followed on Aug. 16, P-384 on Aug. 30, and P-224 on April 3, 1998. The apparent recipe was almost comically simple. Initialize an ordinary random-number generator with a timestamp, produce candidate seeds, test them against mathematical requirements and keep searching until an acceptable curve emerges.

For P-256, the accepted seed appeared at candidate 1,842. For P-224, it took 7,026 candidates. The matches were exact, reproducing all 160 bits of the published seeds rather than merely producing similar-looking numbers. Valsorda independently reproduced the results using the Go programming language, confirming the findings. Anthropic also released code allowing others to check the work. The results provide strong mathematical evidence for the generation method, although they don’t establish precisely who operated the original software or why certain candidates were rejected.

What the Discovery Means for Internet Security

The implications are reassuring, though they don’t amount to a universal security guarantee. One longstanding concern involved the possibility that the NSA possessed enough freedom when selecting seeds to deliberately choose mathematically vulnerable curves. The recovered process appears to have offered far fewer choices than some hypothetical attacks would require. Anthropic’s researchers estimated roughly 30 bits of selection freedom under generous assumptions, considerably less than the approximately 70 bits contemplated in one proposed weakness-selection scenario.

That makes this particular backdoor theory substantially less plausible. Importantly, the discovery doesn’t break elliptic curve cryptography or establish that every possible weakness has been ruled out. It also doesn’t directly affect Bitcoin or Ethereum, which use a different elliptic curve called secp256k1.

Gregory Maxwell Throws Cold Water on Claude’s Big Moment

Interestingly, Bitcoin developer Gregory Maxwell offered a less enthusiastic take, claiming on Hackernews that he had suggested investigating the same cryptographic mystery on Sept. 20 to a friend with expiring Anthropic AI credits. The friend’s AI agent spent hours on the problem without success, leaving Maxwell unimpressed with its reasoning abilities.

Maxwell, an outspoken critic of Anthropic’s approach to AI, questioned whether the company had restricted his friend’s model capabilities and poked fun at the publicity surrounding Claude’s discovery. He stopped short of claiming credit or disputing the findings, suggesting the difference in results might simply reflect how the AI was directed.

“I’m not saying this to suggest that misanthropic hijacked someone elses work yet again– this is an obvious question that many people have surely posed and success presumably depended on expert use (which was absolutely not applied in my friends example),” Maxwell wrote. “But it does make me wonder if the company invisibly degraded the model performance.”

The Bounty Gets Paid, but Questions Remain

The discovery finally settled Valsorda’s three-year-old challenge. Anthropic’s team directed the $36,864 bounty to the Internet Security Research Group, which operates Let’s Encrypt. Valsorda described the finding as something that “helps fill out a page of cryptographic history, and reinforces our confidence in these critical cryptographic primitives.” A few loose ends remain. Researchers haven’t fully explained why some mathematically acceptable candidates were discarded, and the origin of another curve’s seed, B-163, remains unresolved.

Still, the central mystery appears solved. After decades of suspicion, speculation and failed attempts to reconstruct a supposedly forgotten secret phrase, the answer was sitting inside an ordinary 1990s computer routine. The NSA’s mysterious numbers weren’t necessarily hiding an elaborate secret. They may simply have been keeping time.