Claude traces NIST ECDSA seeds to 1990s lrand48

Anthropic says Claude matched NSA-era NIST ECDSA seeds to 1997–1998 lrand48 output, with no cryptographic break.

Anthropic says an internal Claude model reconstructed how NSA-supplied seeds for NIST elliptic curves were generated, seeds The Decoder says NIST standardized in 2000 without a public explanation. The P-192, P-224, P-256, P-384, and P-521 seeds, along with five ANSI X9.62 example seeds, match output from the C library’s lrand48 generator initialized with a Unix timestamp rather than a hashed humorous passphrase. GBHackers, The Decoder, and Cyber Security News place that timestamp between May 1997 and April 1998 and say the work took under 30 minutes; Hacker News says P-256 appeared after 1,842 iterations of 20-byte draws, while Cyber Security News more specifically calls it the 1,842nd candidate from a run started on 16 August 1997 UTC. The Decoder adds that lrand48 emits only 31 bits, matching systematically zero high bits in some seeds, and Hacker News says truncated linear-congruential state was recovered with LLL. Anthropic describes the result as reconstruction of public parameters rather than private keys, with no cryptographic break, new attack, or reason to change deployments, and says a deliberate backdoor is less plausible. GBHackers and Cyber Security News say the B-163 seed and some base points remain unexplained; only the newest report links some base points to FreeLIP and says reproduction code was published. GBHackers, The Decoder, and Cyber Security News all say the $36,864 bounty will go to the Internet Security Research Group.

• Anthropic says an internal Claude model reconstructed the origins of NSA-supplied seeds for NIST curves P-192, P-224, P-256, P-384, and P-521, plus five ANSI X9.62 example seeds.
• The seeds match the C library’s lrand48 generator initialized with a Unix timestamp, not a hashed humorous passphrase; later reports place those timestamps between May 1997 and April 1998.
• P-256 was the 1,842nd candidate, or the result after 1,842 iterations of 20-byte draws; Cyber Security News says that run started on 16 August 1997 UTC.
• The Decoder says lrand48 emits only 31 bits, matching systematically zero high bits in some seeds, and Hacker News says truncated linear-congruential state was recovered with LLL.
• NIST standardized the curves in 2000 using unexplained NSA-supplied seeds; GBHackers, The Decoder, and Cyber Security News say the reconstruction took under 30 minutes.
• Anthropic says this reconstructs public parameters, not private keys, is not a cryptographic break or new attack, and does not warrant deployment changes, while making a deliberate backdoor less plausible.
• GBHackers and Cyber Security News say the B-163 seed and some or several base points remain unexplained; only Cyber Security News links some base points to FreeLIP and says reproduction code was published.
• GBHackers, The Decoder, and Cyber Security News say a $36,864 bounty will be donated to the Internet Security Research Group.