On 16 October Anthropic published a research note: an internal research Claude, in under half an hour, found the origin of the seeds for the NIST prime curves P-192, P-224, P-256, P-384, and P-521. The NSA supplied those seeds to the standard and did not explain them.

[1]
A closed binder standing upright, charcoal cover and muted-blue spine
A closed binder standing upright, its cover painted charcoal and its spine muted blue., AI-generated illustration, not a news photograph

The popular guess was that the seeds were a hash of a joke passphrase. That is not the result. None of the five seeds is the output of any hash. They are outputs of lrand48, an old random-number generator from the C library, started from a Unix timestamp. Anthropic presents this as an account of how the parameters were produced, not as a procedure for a reader to carry out.

[1]

Anthropic says this is not a cryptographic break, not a new attack, and not a weakness in the curves. The authors say an intentional backdoor is now less plausible, because the seeds can be reproduced from an ordinary generator plus a clock. The opening of the note says there is no action to be taken and nothing that needs to be done differently. Most researchers already trusted the curves.

[1]

The account does not cover everything. The base points of P-224, P-256, P-384, and P-521 still do not match the method they found. The fifth binary seed, B-163, matches nothing Claude tried and remains unexplained. The $36,864 bounty for finding the seeds will be donated to the Internet Security Research Group.

[1]