New to this? Read it in simple words
- Five common encryption curves from 2000 were built from numbers the NSA never explained.
- Anthropic says its AI model found that a normal 1990s random generator made them.
- Cryptographer Filippo Valsorda checked the result, and his bounty of $36,864 went to charity.
- It is not a break of the curves, and nobody needs to change anything.
- Elliptic curve
- A kind of maths that much modern encryption and many digital signatures are built on.
- Seed
- A starting number that is turned into the curve’s settings, so others can check how it was made.
- Backdoor
- A hidden weakness that lets someone secretly get around encryption.
In 2000, the US standards agency NIST published five elliptic curves for encryption and digital signatures. Each curve was built from a “seed”, a random-looking number that the NSA supplied with no explanation. An NSA employee, Jerry Solinas, made the seeds in 1997, and he died in 2023.
What Anthropic says its model found
Anthropic’s Frontier Red Team says the seeds came from rand48, a standard random number generator in the C programming language. Each run of the generator started from the computer’s clock, and each candidate seed took 20 bytes of its output.
The clock times fall between May 1997 and April 1998. The seed of P-256, for example, starts from a clock reading of August 16, 1997. It is candidate 1,842 of its run.
Anthropic says an internal research model found the method in under half an hour, and it does not name the model. The team also published code that anyone can run to check the result.
Sources1
From Anthropic’s post and Valsorda’s bounty post of October 16, and our own run of the published method.
An outside check, and a bounty paid to charity
In 2023, Valsorda offered a bounty for the source of the five seeds, with money from 11 other people. It was worth $12,288, or three times that if given to a charity.
Anthropic’s team claimed it on October 15. Valsorda wrote on October 16 that he rebuilt the algorithm in the Go language to check the claim. The full bounty of $36,864 went to ISRG, the non-profit behind the free Let’s Encrypt certificates.
One of the people who funded the bounty, Amir Omidi, is also on Anthropic’s team. CoinDesk and The Decoder reported the finding on October 17.
What it means for the backdoor fears
Because nobody could explain the seeds, some experts feared the NSA had chosen them to hide a weakness. Valsorda notes that Daniel Bernstein and Tanja Lange had described how about 70 bits of free choice could, in theory, aim at a hidden class of weak curves.
He says the finding completely rules out that idea. A clock time from 1997 or 1998, plus a choice among the first few candidates, leaves only about 30 bits of freedom.
“This is not a cryptographic break, new attack, or weakness in the ECDSA curves,” Anthropic wrote. Some questions remain open: one binary curve, B-163, most of the curves’ base points, and why some valid seeds were skipped.
Sources
Every fact in this story comes from the sources below. Open them to check our work.
- 1
- 2Primary source · October 16, 2026The NIST Elliptic Curves Seeds Bounty Has Been Claimed Filippo Valsorda
- 3Primary source · October 5, 2023Announcing the $12k NIST Elliptic Curves Seeds Bounty Filippo Valsorda
- 4Research · October 17, 2026‘Wow, it’s a real discovery’: Claude cracks a 25-year NSA number mystery CoinDesk
- 5Research · October 17, 2026Anthropics’ Claude cracks a 25-year-old NSA cryptography mystery in under 30 minutes The Decoder
The method is checked: Valsorda rebuilt it, and we ran Anthropic’s published method and got the P-256 and P-224 seeds. The half-hour time and the model’s role are Anthropic’s own account.
Anthropic says its model traced the unexplained NIST curve seeds to a 1990s generator, and an outside cryptographer confirmed it, easing backdoor fears. How we rate the mood