Anthropic AI Traces NIST P-256 Seed to 1997 Pseudorandom Number Generator

The resolution of a two-decade mystery enhances trust in widely used cryptographic standards.

• On October 16, 2026, Anthropic researchers announced they traced the NIST P-256 elliptic curve seed to a 1997 lrand48 PRNG run.
• The investigation revealed that the seed's origin was mundane, stemming from a Unix timestamp rather than hidden weaknesses.
• The findings confirmed no evidence of backdoors or vulnerabilities, maintaining confidence in the security of the P-256 standard.

• The NIST P-256 curve, standardized in 2000, has been under scrutiny due to its origins linked to NSA mathematician Jerry Solinas.
• Previous claims suggested the seeds were derived from humorous phrases, but these were unverified and could not be reproduced.
• The 2013 Dual_EC_DRBG revelations heightened concerns about NSA influence in cryptographic standards, making this discovery particularly significant.

In a significant development for cryptographic transparency, Anthropic's Claude AI model successfully traced the seed for the NIST P-256 elliptic curve back to a specific run of the lrand48 pseudorandom number generator (PRNG) from 1997. This investigation was prompted by a bounty challenge organized by Filippo Valsorda, aiming to resolve longstanding questions about the origins of cryptographic parameters that have been in use for decades.

The research team utilized the Claude AI model to analyze the generation method without referencing prior rumors or unverified claims. Within 30 minutes, the model identified statistical patterns consistent with the lrand48/drand48 POSIX PRNG, which was commonly used in Unix systems during the 1990s. The analysis revealed consistent top-bit zeros in 32-bit words, a hallmark of the PRNG's output.

By employing lattice reduction techniques, the researchers were able to recover the 48-bit generator states and trace them back to specific Unix timestamps. Notably, the P-256 seed matched candidate number 1,842 from a run that began on August 16, 1997, at 01:52:34 UTC. This finding not only resolved the mystery surrounding the P-256 seed but also indicated that the origins were far less nefarious than previously speculated.

The implications of this discovery are profound. It alleviates fears of intentional backdoors or weaknesses in the cryptographic standards that underpin secure communications globally. The limited entropy of a timestamp-seeded PRNG suggests that the parameters were not designed with malicious intent. As a result, the resolution has been characterized as reassuring for internet security, reinforcing confidence in the integrity of the P-256 standard.

Moreover, the successful application of AI to unravel this cryptographic mystery opens the door for similar investigations into other undocumented legacy parameters. The market and governmental responses to this discovery have been minimal, but the emphasis remains on maintaining confidence in the security properties of the curve. This incident highlights the potential for AI to enhance transparency and trust in cryptographic systems, which are critical for secure digital interactions.

• Cryptographers: Gain clarity on the origins of widely used standards, enhancing their work's credibility.
• Cybersecurity professionals: Experience reduced anxiety regarding potential vulnerabilities in established cryptographic systems.
• Tech companies: Benefit from increased trust in the security of their products that rely on NIST standards.
• Regulatory bodies: May reassess guidelines and standards based on the newfound transparency in cryptographic origins.

• Future AI applications: Monitor how AI can be leveraged to investigate other cryptographic mysteries, potentially leading to further transparency.
• Industry responses: Watch for reactions from tech companies and cybersecurity firms regarding updates to their cryptographic practices.
• Regulatory changes: Keep an eye on any shifts in regulatory frameworks that may arise from this discovery, particularly concerning cryptographic standards.