Mystery numbers in popular encryption came from a weak generator and the clock

Anthropic says its Claude model has worked out where the unexplained starting numbers behind a widely used digital signature standard came from. The answer is a random number routine from 1990s C software, fed the time of day. The company published the result on its research blog on 16 October 2026, and it deflates a theory that has hung over the standard for decades.

The standard is ECDSA, adopted by the US government’s NIST in 2000. It relies on a short list of fixed mathematical curves, and each curve is built from a 20-byte starting value called a seed. The NSA supplied those seeds and never said how it chose them. A seed picked on purpose, rather than by chance, could in principle hide a weakness only its designer knew about. That is why people kept asking.

The best-known explanation came from Jerry Solinas, a longtime NSA employee. In 2015 he recalled that the seeds were probably a hash of a joke phrase along the lines of “Bob and Jerry rule”, though he could not recall details. He died in 2023, and nobody else involved could confirm it. Several Anthropic employees chased the phrase and found nothing.

According to Anthropic, one curious staff member put the question to an in-house research model in October, with no mention of the phrase. In under half an hour, the post says, Claude had an answer for the five NIST prime-curve seeds. The model reasoned that software of that era would have used a weak generator whose output can be recognized, then wrote a scanner that tested every published seed against 1990s-style generators. A telltale pattern in the leading bits pointed to lrand48, a standard C library function. For the seeds that kept only part of each output, Claude applied a textbook lattice technique to recover the generator’s hidden state, then ran it backwards to the starting value. Those starting values were Unix timestamps from between May 1997 and April 1998.

So the humans supplied the question and the writeup, and the model supplied the method, the code and the search. The post does not say how much the ten named Anthropic authors guided Claude after the first prompt.

On evidence, this is the strong kind. The post includes short public-domain Python that regenerates 14 seeds from a timestamp and a candidate count. P-256, for instance, comes out as the 1,842nd candidate drawn from a generator started at 01:52

UTC on 16 August 1997. Matching 160 bits of output from nothing more than a clock reading and a small counter is not a coincidence. Claude also matched the base points of six prime curves to an older arithmetic library, again with runnable code.

The inferences are softer. The four binary-curve seeds only fit if the program halved the clock, which the post itself hedges with “if that reading is right”. The B-163 seed fits nothing and stays unexplained. The base points for P-224, P-256, P-384, and P-521 are unexplained too.

The finding also leaves one door ajar. The runs skipped some candidates that would have yielded valid curves: for P-256, candidate 876 qualified and was passed over. Anthropic does not know why, and concedes someone could have searched timestamps until a desirable seed appeared. It judges that unlikely, because weak curves would have to be easy to find. Nothing in the numbers reveals how many runs there were.

Anthropic frames the result as grounds for confidence that the curves have no backdoor. That is a reasonable reading of the provenance. It is not a security audit. The post says outright that this is no break and no new weakness, but a mundane origin for the seeds says nothing about other properties of the curves, and the authors do not claim otherwise.

Nobody outside Anthropic has been named as checking the work. The authors are all Anthropic staff, the model is the company’s own, and the bounty organizer, Filippo Valsorda, appears only in the thanks. The post does not say whether he has accepted the result. Anthropic is donating the $36,864 bounty to the Internet Security Research Group.

The cheap test is available to everyone, though. The code runs in seconds, so an independent cryptographer can confirm the timestamps this week, and a failure to reproduce would sink the claim quickly.

Based on Anthropic’s research post of 16 October 2026.