The receipt is a reproducible PRNG transcript, not a new attack on P-256.
Anthropic's cryptography team posted "Claude reveals ECDSA curve origins" on 16 October 2026. The piece argues that long-standing suspicion about NSA-supplied NIST curve seeds can be retired for the recovered prime-curve cases: the seeds match lrand48 output from clock-seeded states, which anyone can regenerate. The authors say most researchers already trusted the curves; the contribution is closing the provenance riddle and publishing code.
This Record reads the post as evidence: what was claimed, what was measured, what remains open. It is not a buyer mandate to rotate TLS certificates.
Claim of novelty
Provenance, not a break. Anthropic claims Claude recovered how several published ECDSA seeds were generated. The seeds for NIST P-192, P-224, P-256, P-384, and P-521 are presented as consecutive 20-byte candidates from lrand48, after srand48(t) with Unix timestamp t, not as hashes of a humorous passphrase (the Solinas-era rumor). Example printed: P-256 seed C49D3608…819F7E90 as candidate 1842 from timestamp 1997-08-16 01:52:34 UTC.
Method sketch on the post. Claude scanned seeds for 1990s PRNG fingerprints, noticed top-bit patterns consistent with lrand48 returning 31-bit chunks, recovered truncated LCG state via lattice / LLL windows, then stepped state backward to srand48 form (low 16 bits = 0x330E). For ten prime-curve seeds (NIST plus ANSI X9.62 examples), those initialization states decoded as timestamps from May 1997 through April 1998. Binary-curve cases on the post use a halved-clock reading for April 1998 runs.
Selected base points. For six May 1997 curves (P-192 and five ANSI examples), Claude matched base-point x-coordinates to FreeLIP / early NTL zrandom recipes with small integer seeds (20000, 20420, …). Anthropic says it believes no NIST base point had been explained publicly before. P-224, P-256, P-384, and P-521 base points do not fit that recipe on the post.
Skipped viable candidates. The post notes other candidate indices in the same runs (for example P-256 candidate 876) also yield prime-order curves of the right size; why they were skipped is unknown. Authors argue the small skip count makes deliberate weakened-curve search implausible, while leaving open in-principle timestamp search if disclosure of the timestamp were planned.
What was measured and on which data
Artifacts measured: published NIST / ANSI seed bytes and selected base-point coordinates, against regenerated lrand48 / FreeLIP streams. The post prints Python that regenerates named seeds and a second script that checks FreeLIP-style base-point matches.
Success criteria on the post: bit-exact regeneration of 160-bit seeds from recovered 48-bit states and candidate indices; base-point x matches for the six FreeLIP cases. Timing claim: "under half an hour" for an internal research model session started without the passphrase clue.
Negative results printed: B-163 binary seed unrecovered; NIST binary-curve base points unexplained; P-224/P-256/P-384/P-521 base points unexplained.
Social proof / bounty: Filippo Valsorda's NIST Elliptic Curves Seeds Bounty is acknowledged; $36,864 to be donated to the Internet Security Research Group. Author list includes John Wood, Henry de Valence, Nicholas Carlini, Steve Weis, and others at Anthropic.
Baseline fairness
Comparison is to folklore and prior failed searches, not to a competing cryptanalysis paper with a shared harness. The passphrase-hash hypothesis is treated as the prevailing story (Solinas 2015 quote on the post) and shown false for the recovered seeds.
Reproducibility standard: public code on the page under CC0 for the listed snippets. Anyone can verify seed regeneration without Anthropic's model.
Model credit boundary: the post attributes discovery to an internal Claude research model guided by Anthropic cryptographers. It does not present a controlled human-only ablation of the same search.
What was not tested
- Any new attack that forges ECDSA signatures faster than the public curves already allow.
- Side-channel or implementation bugs in popular TLS stacks.
- Completeness of all ANSI / NIST binary seeds (B-163 open).
- Why skipped candidates were rejected (criteria undisclosed).
- How many timestamp runs were tried historically at NSA (unknowable from the arithmetic alone).
- Whether every production system should re-generate curves (authors explicitly say no action required).
Code / weights / data public?
Post: https://www.anthropic.com/research/ecdsa-curve-origins (16 October 2026).
Code: reproduction snippets on the page; authors waive rights under CC0 1.0 to the extent possible.
Weights: not a model-weight release; Claude here is an internal research system.
Data: published curve parameters from FIPS / ANSI; no new secret NSA archive dump is claimed.
Monday use or why not
Use this week when: you need a citable close to the "NSA backdoored the seeds" hallway argument for P-256-class prime curves named on the post; or you want the reproduction scripts in a cryptography reading group.
Do not use this week as: a reason to rotate certificates, abandon ECDSA, or claim Claude "broke" NIST curves. Anthropic's headline guidance is that confidence in the curves increases because generation looks mundane and reproducible.
Operational note: keep B-163 and unexplained base points on the open-question list before declaring the entire NIST suite provenance-complete.
Relation to the last paper in the line
Koblitz & Menezes, "A Riddle Wrapped in an Enigma" - cited framing for the controversy; this post claims an empirical resolution for named seeds rather than a new hardness proof.
FIPS 186-2 / ECDSA standardization - the seeds' public appearance without provenance is the historical object; the Record does not re-litigate curve selection math beyond what Anthropic measured.
Prior Frontier security Records (NIST agent 800-5 lineage in corpus) - different object (agent threats vs curve seeds); share only the desk habit of reading primary technical claims as evidence.