For more than two decades, one of the most important strings of numbers in internet security came with no explanation. The seed behind the NIST P-256 elliptic curve, also known as prime256v1, simply showed up in the standards, and nobody could say where it came from.
Researchers from Anthropic now say they know. Using the Claude AI model, they traced the seed to a garden-variety random number generator that was started on August 16, 1997, at 01:52:34 UTC. The origin story turned out to be mundane, which is roughly the best outcome a cryptographer could hope for.
How a 1990s random number generator cracked the case
According to the Anthropic findings, the P-256 seed (C49D360886E704936A6678E1139D26B7819F7E90) was produced by lrand48/drand48. That is the POSIX-standard pseudorandom number generator, a routine tool on Unix systems of that era.
The generator had been seeded with a Unix timestamp, 871696354, which converts to that August 1997 date. The P-256 seed corresponds to candidate #1842 from that run. Put more simply, someone started a standard random generator, let it produce candidates, and one of the outputs became the seed.
The pattern held across other curves too. Seeds for the prime curves P-192, P-224, P-384 and P-521 matched timestamps falling between May 1997 and April 1998. Seeds for the binary curves showed patterns consistent with timestamps from either February 1984 or April 1998.
Claude reportedly recovered the generation method in under 30 minutes by working through the habits of 1990s PRNGs.
The findings were announced on October 16, 2026. They followed the completion of a $36,864 bounty challenge set by cryptographer Filippo Valsorda. The Anthropic team claimed the bounty and then donated the funds to the Internet Security Research Group (ISRG).
Why anyone suspected the NSA in the first place
The seeds were handed to the ANSI X9.62 committee in fall 1997 by Jerry Solinas, a mathematician at the NSA. That committee was working on the ECDSA signature specification. NIST then standardized P-256 in 2000 in FIPS 186-2, building on the ANSI X9.62 work.
Suspicion intensified sharply after the 2013 Dual_EC_DRBG revelations. Those disclosures put the NSA’s role in cryptographic standardization under a microscope, and P-256’s unexplained seed became a recurring talking point in that debate.
Earlier accounts suggested the seeds were SHA-1 hashes of humorous phrases. Nobody could reproduce that claim, which left the joke theory sitting in the same unverifiable bin as the backdoor theory.
What the discovery means for internet security
The core finding is reassuring. The analysis found no evidence of intentional cryptographic weaknesses in how the seeds were produced.
A backdoored curve would require its designer to search through a huge number of seeds until finding one with a hidden, exploitable property. A seed pulled from lrand48 started at a specific second leaves very little room for that kind of shopping. The research notes that this limited entropy reduces the plausibility of a backdoor.
There is a less flattering takeaway, too. The seeds were not produced using the kind of transparent, “nothing up my sleeve” methodology that modern cryptographers prefer. They came from an ordinary tool, started at an arbitrary moment, with the details apparently never written down for the public.
The crypto and AI angles
A question that stumped human researchers for decades was answered by a model that recognized how 1990s software tended to behave. That suggests other legacy mysteries in cryptography, the ones buried in old standards and undocumented parameters, could be worth revisiting with similar tools.
For security teams, the practical stakes are about confidence rather than code changes. P-256 has been everywhere for years, and nothing about this discovery alters the curve itself.
Disclosure: This article was edited by Diego Almada Lopez. For more information on how we create and review content, see our Editorial Policy.