Claude Cracks ECDSA Curve Mystery, Rules Out NSA Backdoor

Claude approached the problem differently. Rather than searching for a passphrase, it reasoned about how the software that generated the curves in the 1990s must have worked. It guessed the authors used a pseudorandom number generator that shipped with C libraries of the era. Those old generators are weak enough that their output can be recognized, and recognizing it can reveal which generator was used and possibly let you recover its state.

Claude wrote a scanner that slid along each published seed one bit at a time, testing whether adjacent chunks looked like consecutive outputs of a 1990s-vintage generator. The scan covered 34 combinations of generator and output slices. Then it spotted a pattern: for some seeds, the top bits of the five 32-bit words were all zero. Four of the ten seeds had a 0 in the top bit for all 20 words, something that would happen by chance with probability 1 in 5,810. That signature pointed to lrand48, which returns only the top 31 bits of a 48-bit state.

To recover the hidden state, Claude tried all 2¹⁷ possible values of the 17 missing bits and checked whether the next four words followed. That worked for all four seeds. The remaining prime-curve seeds came from the same generator but kept fewer bits of each output. Recovering a truncated linear congruential generator is a textbook lattice problem, solved with the Lenstra–Lenstra–Lovász algorithm. Claude ran the solver over every window until all ten prime-curve seeds matched the same pattern.

Each recovered 48-bit state regenerates all 160 bits of its seed, which Anthropic says cannot happen by chance. Because the generator runs backwards as easily as forwards, Claude stepped each state back until it reached the form srand48 would have initialized, with the low 16 bits equal to 0x330E. For the ten prime-curve seeds, every initialization was a Unix timestamp falling between May 1997 and April 1998.

Anthropic is explicit that this is not a cryptographic break, a new attack or a weakness in the ECDSA curves. If anything, the company says the discovery makes it more confident the curves were chosen without backdoors or intentional weaknesses. The seeds were generated in a simple, reproducible way — a common pseudorandom number generator initialized from the clock — which leaves far less room for subversion than a mysterious hash of a secret phrase.

The finding also closes a human story. Jerry Solinas, a longtime NSA employee, had been the leading candidate behind the humorous-passphrase theory, but he died in 2023 and former colleagues were not responsive, leaving the question open. Anthropic says most researchers already trusted the curves, and that the takeaway for the cryptographic community is closure rather than alarm.

For readers in Tunisia, the practical impact is essentially nil. ECDSA is buried deep in the plumbing of the internet, securing websites, banking apps and messaging services, and Anthropic says there is nothing to change or update. No new patch, no new key, no new standard. The work is a research result about how the parameters were originally picked, not a flaw that someone can exploit.

If you use HTTPS, a banking app or any encrypted service, the certificates and signatures you rely on today remain as trustworthy as they were yesterday — arguably more so, since the long-standing suspicion around the NIST seeds now has a mundane explanation. Availability of Anthropic's Claude models in Tunisia is a separate matter and is not addressed by this research; readers should check Anthropic's own regional availability before signing up.