For a quarter century, cryptographers wondered whether the NSA had quietly rigged the numbers behind a set of widely used elliptic curves. The answer, it turns out, may be a pseudorandom generator from an old C library, found by an AI model in under half an hour. Nobody ever promised the explanation would be glamorous.
The puzzle, in brief
In 2000, the US National Institute of Standards and Technology (NIST) approved a set of elliptic curves proposed by the NSA. These curves sit inside public-key cryptography, where they let you prove you hold a secret key without revealing it. Useful, and unremarkable, until you ask where the curve parameters came from.
The agency never explained the origin of some of the numbers used to build the curves. That silence invited an obvious suspicion. Perhaps the NSA tried a great many candidates and picked one that gave it a way around the protection. Edward Snowden's revelations about attempts to weaken cryptographic standards did nothing to calm that suspicion.
In cryptography, an unexplained constant is rarely treated as a charming quirk.
A long list of people who tried
The riddle had a distinguished audience. Cryptographers Neal Koblitz and Alfred Menezes laid out the history in a 2015 paper titled "A Riddle Wrapped in an Enigma." Menezes had a personal stake. He took part in preparing the original standard, and he recalled receiving the seed values from NSA mathematician Jerry Solinas in 1997.
Security researcher Steve Weis spent years looking for an explanation, including by filing requests for government documents. In 2023, cryptography engineer Filippo Valsorda and other community members put up a bounty for solving the mystery. The base reward was $12,288. If the winner passed the money to charity, it could grow to $36,864.
So: decades of scrutiny, formal requests, a paper, and a cash prize. The thing that finally moved was a language model.
What Claude actually did
An Anthropic employee gave an internal Claude model the job of investigating the origin of the numbers on its own. One detail matters here. The model was not told about the hypothesis that the seeds might have been derived from a forgotten phrase. It had to find its own way in.
It did. The model reconstructed the number sequence using lrand48, a pseudorandom generator from an old C programming library. Such generators follow a fixed algorithm, so given the same starting parameters they reproduce the same output every time. That repeatability is what makes the whole trick possible.
The model linked five seed values to this generator in less than 30 minutes. For one of the values, the one used in building the P-256 curve, it found an exact match on the 1842nd variant it checked. Timestamps from 1997 and 1998 helped tie the sequence to the historical record.
What is still unexplained
The story is not fully closed, and the report is candid about that. It remains unclear why the program skipped some candidates that would have been suitable. It is also unclear how the other curve parameters were chosen.
So the origin of the seeds now has a plausible, reproducible answer. The full decision process around them does not.
What this means for people using these curves
The finding lowers the odds that NIST's curves carry a deliberately planted mechanism for bypassing their protection. A seed produced by an ordinary, reproducible generator looks much less like a needle picked from a haystack of options, though the open questions above keep this short of a complete acquittal.
Two further points keep the news in proportion:
- No secret key surfaces. The published seed values were always available. Discovering how they were generated does not expose any hidden NSA key, and it does not by itself compromise any system.
- No action required. Anthropic said users of these curves do not need to change settings or move to other algorithms.
One more clarification for the crypto-adjacent. The secp256k1 curve, which Bitcoin uses, was not part of this story. Its parameters are built differently, and the riddle does not apply to it.
Where the money goes
The bounty will be directed to the Internet Security Research Group, the nonprofit that supports Let's Encrypt, the project that issues free security certificates for websites. A tidy ending for a prize that began as a bet on whether the NSA had been up to something.
The takeaway
The most interesting part may be the method rather than the verdict. A human gave a model an open question, withheld the popular theory, and the model arrived at an answer that people had chased for 25 years. Skeptics will reasonably want the leftover questions answered, and the report says plainly that they are not yet.
Still, the likely explanation for the great NSA mystery is a standard library function that anyone could have called in 1997. Conspiracies are usually more exciting than their sources.