For 25 years, cryptographers chased the origin of a handful of numbers the NSA handed to the U.S. government. An Anthropic research model traced them in less than half an hour. The answer is far more boring than the conspiracy theories: an ordinary random-number program fed timestamps from 1997 and 1998.
That’s good news for anyone who was worried about a backdoor. It doesn’t answer every question, though, and Anthropic said so itself.
The search went nowhere for years
This month, an Anthropic employee asked an internal research model to look into the problem. The employee didn’t share the leading theory that had been sending human investigators in circles: that the seeds came from a humorous phrase NSA mathematician Jerry Solinas had later forgotten.
That detail matters. Without the phrase theory in its context, the model went another way. It traced five NIST curve seeds to lrand48, a random-number generator found in older C software libraries.
Next it rebuilt the sequence behind P-256, one of the most widely used curves, and found an exact match for its published seed at the 1,842nd candidate.
The model briefly suspected it was being tested
The recorded reasoning is the strangest part of the story. Before accepting its own result, the model questioned whether it was working inside a simulated test.
“This is astonishing: it solves the 25-year-old mystery,” the model wrote. It then checked itself: “Hmm, is it plausible in reality? As of my knowledge … the bounty was unsolved.” After noting that all 20 top bits were clear, a one-in-a-million chance, it concluded: “So indeed real-world.”
That’s a model reasoning about the odds of a coincidence, which is what a skeptical human would do first. Credit where it’s earned.
Why anyone cared about a few seeds
Much of the internet runs on elliptic-curve cryptography, the same family of math that protects bitcoin wallets. It lets you prove you hold a secret key without revealing anything about the key itself.
Think of a curve as a lock design anyone can inspect. Every user has a private key, but all of them depend on the design being hard to break.
In 2000, the U.S. National Institute of Standards and Technology, or NIST, adopted a set of curves supplied by the National Security Agency. The starting numbers, called seeds, were public. How the NSA picked them was never explained.
The worry was simple. If the agency tried many seeds until one produced a curve with a flaw only it knew about, it would hold a key to every system using that curve. The tinfoil version of the theory said exactly that.
Snowden made the suspicion harder to wave away
The silence looked worse after the Snowden disclosures tied the NSA to efforts to weaken cryptographic standards. NIST later pulled one of those tools, the Dual EC random-number generator, from its recommendations.
Cryptographers Neal Koblitz and Alfred Menezes took on the controversy in their 2015 paper, “A Riddle Wrapped in an Enigma.” Menezes had helped write the original standard and recalled receiving the seeds from Solinas in 1997.
Security researcher Steve Weis spent years on it, including public-records requests filed in 2018. NIST said it had no documentation. The NSA stopped responding.
In 2023, cryptography engineer Filippo Valsorda and other contributors put up a $12,288 bounty, rising to over $36,000 if the winner donated it to charity. Solinas died earlier that year, leaving researchers with old recollections and the numbers themselves. Neither got them anywhere.
What’s solved and what isn’t
Anyone can now rerun the program and get the exact numbers the NSA supplied. Anthropic said that makes a hidden weakness much less likely.
But the team still can’t explain why the program skipped some usable candidates, or how other parts of the curves were chosen. A deterministic origin for the seeds is a strong answer to one question. It isn’t a full audit.
Anthropic said in its blog that people using the NIST curves don’t need to change anything.
The same trick would wreck a crypto wallet
That predictability is exactly what let Claude rebuild the seeds. Inside a wallet, it would be a disaster. A secret key generated with lrand48 could be recreated by anyone who figured out roughly when it was made, handing them everything needed to drain the funds.
The NSA’s seeds were public from day one, so there was never a secret to steal here.
Bitcoin was never part of this puzzle. Its wallets use secp256k1, a curve built from a simpler equation defined by two small, fixed numbers that leave almost nothing to adjust. P-256’s version carries a 77-digit number that came out of the NSA’s unexplained seed.
With so few dials to turn, there’s little room to slip a weakness into bitcoin’s curve, and cryptographers have long counted that in its favor. Satoshi Nakamoto never publicly explained the choice, and the curve was rarely used before bitcoin made it famous. Ethereum later adopted it, and bitcoin kept it when its 2021 Taproot upgrade introduced a newer style of signature.
Quantum computing is the threat that’s still open
A powerful quantum computer would pose a different risk. It could work backward from a public key visible on Bitcoin’s blockchain to the secret key behind it, no matter how the curve was chosen.
The hardware keeps inching closer. Google said this week its Willow chip cut errors about 40-fold in one of the costliest steps such a machine would need.
Still, nobody has built a quantum computer anywhere near large or reliable enough to crack a bitcoin key, and there’s no clear timeline for when one might arrive.
As for the prize, the $36,864 bounty is going to the Internet Security Research Group, the nonprofit behind Let’s Encrypt, which hands out free security certificates to websites. So money raised over a suspected NSA backdoor ends up paying for free encryption on the web.
