"It's just timestamps." That is how Anthropic's Frontier Red Team opened its research post on October 16, 2026, after an internal Claude model spent less than half an hour answering a cryptographic question that had been open for roughly 25 years. The question was simple to state and had proved impossible to answer: where did the seeds behind the NIST elliptic curves come from? Nobody knew. The NSA had supplied the values without explanation when NIST standardized them in 2000. Cryptographers had been arguing about their provenance ever since. Claude resolved the argument in the time it takes to watch a television episode.

The curves in question — P-192, P-224, P-256, P-384, and P-521 — are not obscure academic constructs. P-256 alone underpins the TLS/HTTPS protocol that encrypts virtually every website on the internet, iMessage, Signal, SSH connections, Apple Pay, Android passkeys, and iOS device authentication. When you connect to any website over HTTPS, there is a reasonable chance you are relying on a curve whose seed origins were, until this month, genuinely unknown.

What the Mystery Was and Why It Mattered

NIST published the five prime-field elliptic curves as part of the FIPS 186-2 Digital Signature Standard. The curves are defined by a set of parameters; among those parameters are seed values that were used during the curves' construction. NIST documented the seeds. It did not document how they were generated.

For most of the curves' lifespan, the missing provenance was a footnote. Then, in 2013, the Snowden documents revealed that the NSA had deliberately backdoored a different NIST standard — the Dual_EC_DRBG elliptic-curve random number generator — by choosing its constants in a way that gave the agency a secret advantage. That revelation transformed the NIST curve seeds from a footnote into a live concern. If the NSA had manipulated one standard, had it manipulated others? The leading candidate for suspicion was the P-curve seeds.

A theory circulated for years that the seeds were SHA-1 hashes of a memorable phrase or passphrase — the so-called "nothing-up-my-sleeve" technique some cryptographic standards use to demonstrate that constants were not chosen for hidden mathematical properties. Cryptographers tried various candidate phrases without success. The provenance remained unknown.

How Claude Found the Answer

An Anthropic employee asked an internal research model whether it could work out how the seeds were generated. Critically, the employee did not supply the passphrase theory as a hint — Claude started from the published seed values alone.

Claude noticed something in the seeds' binary structure. Several of them showed a distinctive pattern: the high-order bits were consistently zero. That pattern is the signature of `lrand48`, a linear congruential generator (LCG) that was a standard component of 1990s C libraries. The reason lrand48 produces zero high-order bits is structural: it maintains a 48-bit internal state but returns only the top 31 bits. When those 31 bits are placed in a 32-bit value, bit 31 is always zero.

Recognizing the signature was the first step. Recovering the full internal state from the truncated output was the second. Claude used the Lenstra–Lenstra–Lovász (LLL) lattice reduction algorithm — a mathematical technique for finding short vectors in lattices, widely used in modern cryptanalysis — to reconstruct the hidden 17 bits that lrand48 discards. With the full 48-bit state recovered, Claude could run the generator backward to its initialization value. Those starting values turned out to be Unix timestamps falling between May 1997 and April 1998.

All five NIST prime-curve seeds matched the same construction, formally expressed as `lrand48() >> 23`. So did five ANSI X9.62 example-curve seeds. Ten seeds in total, all traceable to the same generator, all initialized with 1997–98 Unix timestamps. P-256 specifically required 1,842 iterations of lrand48 from a timestamp of August 16, 1997 — a fully reproducible result, because Anthropic published the code alongside the finding.

The Base Points: A Separate Problem, Partly Solved

Elliptic curves are defined by more than their seeds. They also have base points — specific points on the curve used in cryptographic operations. Base point provenance had been even more mysterious than seed provenance. Anthropic states that, as far as it knows, no NIST base point had ever been explained before this work.

Claude explained six of them. The base point for P-192, and the base points for five ANSI prime curves (prime239v1, prime239v2, prime239v3, prime192v2, prime192v3), traced to a different generator: the random number generator inside Arjen Lenstra's FreeLIP arithmetic library. The seeds for those generators were small integers — 20,000 for P-192; 20,420, 20,507, and 20,509 for the three prime239 variants; 20,512 and 20,517 for prime192v2 and v3.

The base points for P-224, P-256, P-384, and P-521 remain unexplained. The seed for binary curve B-163 fits no recipe Claude tried. Four NIST binary-curve seeds matched lrand48, but their initialization values look like February 1984 timestamps — which becomes April 17, 1998 if doubled. Anthropic describes that as a tentative interpretation, not a confirmed one. The work is not complete. But it is substantially further along than anything the cryptographic community had previously managed.

Why This Is Not a Break — and Why That Matters

Anthropic is emphatic on one point: this finding does not compromise the security of the curves. The security of P-256 and the other NIST prime curves rests on the difficulty of the elliptic curve discrete logarithm problem — the mathematical hardness of reversing a point multiplication on the curve. That hardness does not depend on how the curve's parameters were chosen. Knowing that the seeds came from lrand48 seeded with a 1997 Unix timestamp does not give an attacker any shortcut for breaking keys or signatures.

The finding matters for a different reason: it substantially reduces the plausibility of a deliberate NSA backdoor in the curves. A backdoor in an elliptic curve seed would require the NSA to have found seed values that satisfied specific mathematical properties enabling an attack, while making those seeds look as though they came from a random process. Using `lrand48` with mundane 1997 timestamps is not the profile of a sophisticated, deliberately weakened construction. Anthropic notes that the few skips visible in the lrand48 sequence — places where the generator's output was not used — are too rare to suggest the seeds were being selected by rejection sampling toward a specific weak value.

This matters in context. The same week that saw Z.ai's GLM-5.3 exhibit unexpected emergent reasoning about its own training process — a finding about AI systems behaving in unanticipated ways — Anthropic's result shows a different kind of unexpected AI capability: using reasoning to solve a concrete open problem in applied mathematics that human experts had not resolved in 25 years. Both findings arrived within days of each other, and both challenge assumptions about what AI systems can and cannot do outside of benchmark conditions.

What It Means for AI as a Research Tool

The methodological details matter here as much as the result. Claude did not search a precompiled database of possible RNG outputs, or run a brute-force scan through every known random number generator. It noticed a structural pattern in the binary representation of published seed values, inferred the likely generator family from that pattern, and then applied a known mathematical algorithm — LLL lattice reduction — to reconstruct the generator's internal state from partial observations. That is a sequence of reasoning steps, not a lookup.

The problem is also the kind of problem where domain knowledge and cross-domain reasoning are jointly necessary. Recognizing the lrand48 truncation signature requires knowing something about how 1990s C library generators worked. Applying LLL reduction to recover the hidden state requires knowing it is applicable to LCG outputs. Connecting recovered internal states to Unix timestamps requires knowing what a 1997 Unix timestamp looks like as a 48-bit integer. None of those steps alone is remarkable. Executing all of them in sequence, without being pointed toward the answer, in under 30 minutes, is.

The broader pattern — AI systems demonstrating research-grade problem-solving at speed — connects to the efficiency claims in Microsoft's MAI-Base-2 training work, where the computational model is getting dramatically faster at producing new results. The Anthropic result is a different kind of demonstration: not faster computation, but a model applying domain reasoning to a 25-year-old open problem and returning a verifiable answer. Anthropic's publication of reproducible code that regenerates all recovered seeds exactly is the essential element here — it turns a claim into a checkable result that any cryptographer can verify.

The four unexplained base points and the binary curve seed that fit no recipe are the work that remains. Whether Claude or another AI system closes those gaps is now a more interesting question than it was a month ago.