Claude cleared the NIST curves, and now Anthropic owes us its search log

Since 2000 the P-256 seed, C49D3608 86E70493 6A6678E1 139D26B7 819F7E90, has sat in a federal signature standard with no explanation from the NSA, which supplied it. On 16 October Anthropic said an internal Claude model had worked out, in under half an hour, that it was candidate 1,842 from lrand48, the C library’s bargain-bin random generator, seeded with the Unix clock at 01:52:34 on 16 August 1997. I think this is the first time an AI system has closed a trust question in cryptography, where the question was whether a spy agency rigged something. Having done that, Anthropic now owes the field what the NSA never gave it: the complete working.

I expected a press release with a benchmark-shaped hole in it. What surprised me is how little of the core result asks you to trust Claude. lrand48 keeps 48 bits of state and returns only the top 31, so its output has a fingerprint. Four of the binary-curve seeds, split into 32-bit words, had the top bit clear in all 20 words, which Anthropic puts at 1 in 5,810 by chance. Brute-forcing the 2^17 hidden bits recovered the state. The prime-curve seeds were truncated harder, to lrand48() >> 23, and fell to LLL lattice reduction, the standard tool for truncated linear congruential generators. Run the generator backwards to the form srand48 produces, with 0x330E in the low 16 bits, and the ten prime-curve states land on timestamps between May 1997 and April 1998. The chance that a 48-bit state regenerates all 160 bits of a published seed by accident is negligible. Filippo Valsorda checked it and paid out his bounty, $12,288 tripled to $36,864 for donating it to the Internet Security Research Group. CellCog ran the published script and reports that all nine NIST seeds it covers match FIPS 186-2 exactly.

Dual_EC_DRBG is why anyone cared where these seeds came from. Reuters reported in 2013 that RSA had taken $10 million to make that NSA-linked generator its default, and NIST pulled it from draft guidance on 21 April 2014. The NSA itself conceded that its advocacy for Dual_EC cast suspicion on the rest of its standards work. AI Weekly files this alongside Claude results in CRISPR and algebraic geometry. I would file it separately: those are research problems, and this one was an accusation, answered with a script anyone can rerun.

Valsorda pushes back on the drama, writing that practitioners had no serious concerns even before this. He leans on Koblitz and Menezes’ 2015 argument that the NSA could hardly have planted a weakness that then survived 15, now 25, years of cryptanalysis. I agree the curves were probably fine. But that confidence rested on an argument from plausibility, and after Dual_EC many people stopped accepting plausibility arguments about NSA parameters. A timestamp you can type into Python is a different and stronger kind of evidence, and it reaches the people who never found the plausibility argument convincing.

It is also unfinished, and the unfinished parts are where the search log matters. B-163 fits nothing Claude tried. Nobody can yet say how the generator points of P-224 and the three larger prime curves were picked. And the NSA’s program walked past viable curves: candidate 876 of the P-256 run also yields a prime-order curve of the right size, built the same way. Valsorda says there are two undocumented selection criteria, “one fairly clear and one that still escapes us”. Anthropic itself concedes that nothing in the numbers shows how many runs the NSA did.

The same gap applies to the discovery. The post says the scanner covered 34 combinations of generator and output slice. It does not say how many other hypotheses, windows and transforms were tried and dropped. For the 160-bit matches that count barely matters. For the softer claims it matters a lot. The binary seeds decode to February 1984 and only become April 1998 if you double the timestamp, which the post itself presents as a maybe. The base-point recipe discards exactly seven outputs. Those are fitted parameters, and to judge them I need to know how many alternatives were tried. The excerpt of Claude’s reasoning is also stitched together with ellipses, an odd choice in a post celebrating the end of unexplained gaps. MadRobot pointed out on launch day that the results were Anthropic’s own and not yet independently confirmed.

Anthropic should release the unedited transcript of that half hour, every dead end included, before anyone starts hunting B-163. Until then, open the published script, keep the 1997-08-16 01:52:34 timestamp, change 1842 to 876, and look at the curve the NSA’s program generated and threw away.

Prompted by Claude reveals ECDSA curve origins, anthropic.com.