NIST's curve seeds were timestamps. No record said so.

The seed behind P-256, one of the NIST elliptic curves used for digital signatures, was the 1842nd output of an old C library random number generator, lrand48, started from the computer's clock. Anthropic published that on 16 October, along with the same answer for P-192, P-224, P-384 and P-521. The timestamps point to dates between May 1997 and April 1998. A Claude research model found the method in under half an hour.

It is, in the post's words, "not a cryptographic break, new attack, or weakness in the ECDSA curves." Nobody needs to change anything.

What I keep thinking about is the other date in the story. In September 2019, answering a freedom of information request from Steve Weis about where those seeds came from, NIST wrote that it had "no documents that are responsive." Weis is one of the people credited on this week's post. The answer took seven more years and was read out of the numbers themselves, because no record of how they were made had ever turned up.

So the question: how do you show a random number wasn't chosen, and why did this one take more than 25 years?

What exactly was found?

NIST adopted ECDSA in 2000, with curve seeds supplied by the NSA and no explanation. The best story for years, according to Anthropic, was that Jerry Solinas at the NSA had hashed a humorous passphrase. "That turned out to be wrong." Solinas died in 2023, so there was nobody left to ask.

The method Claude found was plainer: a loop drawing 20-byte candidates from lrand48, seeded with a Unix timestamp. P-256's seed came out on iteration 1842. Oddly, a few valid candidates along the way, such as number 876, were skipped, and the post says nobody knows why. It also explained six base points. It did not explain the base points for P-224, P-256, P-384 or P-521, or the seed for the binary curve B-163. The team published code under CC0 that regenerates the seeds, and the $36,864 bounty for finding them goes to the Internet Security Research Group.

My first reaction, and the check

My first reaction was relief, followed by a slightly smug thought: all those backdoor theories, and it was the clock.

That doesn't hold up. Unexplained constants from the NSA had form. The DES S-boxes were supplied with no explanation and, as the Wikipedia history puts it, "turned out to be far from random", chosen to make the cipher resist differential cryptanalysis. That time the hidden choice made the cipher stronger. Dual_EC_DRBG went the other way: its constants drew criticism in 2007, and later leaks suggested a backdoor. Treating the P-curve seeds with suspicion wasn't paranoia. It was a reasonable reading of the record.

And the reconstruction has one gap the post states plainly: "Nothing in the numbers shows how many runs there were." You can now see the program. You can't see whether it was run once or many times with different start times until someone liked the result. The post says the findings make a backdoor "much less plausible." Less plausible is the most the numbers alone can give.

Who already does this well?

California puts candidates on the ballot in a random alphabet order. On 12 March 2026, under Elections Code section 13112, staff in the Secretary of State's Elections Division drew the letters for the June primary "in a lottery-style drawing, with witnesses from the press observing virtually." A recording went up on YouTube. The order started Q, T, P, W, Z.

Nobody will ever need to reverse-engineer that alphabet. Q, T, P is no more random than a hash output. What the drawing adds is a record of the one thing the letters themselves can't show: that it happened once, at a stated time, in front of people with no stake in the result.

In both cases the number is cheap. The expensive, trust-making part is the record of the draw. California spends one short drawing and a video upload on it. NIST's process left nothing anyone has found, and the bill came as decades of doubt.

What does this mean beyond cryptography?

Plenty of systems run on numbers someone generated once: random audit samples, seeds in simulations, the order of a lottery for school places, the shuffle in a clinical trial's allocation. In each, "it's random" is a claim about a process, and the process is gone the moment it ends unless someone records it. I wrote on 8 October about hijacked registries minting real Google certificates, another case where a valid-looking output told you nothing about how it came to exist. Same shape, different layer.

How sure am I?

What I can't tell from here is whether that record ever existed and was lost, or was never kept. The FOIA appeal has no decision in the file I read.

Sources

• Anthropic, Claude explains the origins of the NIST ECDSA curve seeds, 16 October 2026.
• MuckRock, Origin of FIPS 186-4 elliptic curves over prime field seed parameters (NIST), request by Steve Weis, 2019.
• Wikipedia, Nothing-up-my-sleeve number.
• California Secretary of State, Results of the randomized alphabet drawing for the June 2, 2026, Primary Election, 12 March 2026.