The NIST P-256 seed has been an open puzzle for about 25 years, and Anthropic says it has now been explained. In a post dated October 16, 2026, the company says its Claude model worked out in under half an hour where the seeds behind five NIST elliptic curves came from. According to Anthropic, they were not hash outputs at all, but the output of an old C random-number generator started from a 1997 or 1998 Unix timestamp. Anthropic stresses that this is not a break or a backdoor. Here is what it says, and what it says is still unanswered.
Where the NIST P-256 seed came from, per Anthropic
The seeds were published with the NIST curves in 2000, and a hash of each seed defines one coefficient of its curve. Anthropic says they came from the NSA with no explanation, which fed years of speculation. The best-known story was that NSA employee Jerry Solinas generated them from a hash of a humorous passphrase; in 2015 he said he did not remember the details. He died in 2023.
Anthropic says a curious employee asked an internal research model in October 2026 to find the origin without that clue. Claude concluded that the P-192, P-224, P-256, P-384 and P-521 seeds came from the C library’s lrand48 generator, seeded with a Unix timestamp. Each iteration draws 20 bytes as a candidate seed, and P-256 needed 1,842 iterations. For the ten prime-curve seeds, five NIST and five from the ANSI X9.62 standard, the timestamps fall between May 1997 and April 1998.
Anthropic published short reproduction code and released it to the public domain. I ran the P-256 line myself, and it printed the published seed.
What Anthropic says this means for P-256
Anthropic says this is not a cryptographic break, new attack or weakness in the curves. It argues the finding makes backdoors “much less plausible”, because the seeds came from a common generator started from the clock, which anyone can now reproduce. It calls the post a “fun closing chapter” and says readers need to take no action. It also notes that most researchers already trusted the curves.
What is still open about the NIST P-256 seed
Anthropic is open about the gaps. Not every candidate seed gives a usable curve, and some viable ones were skipped. For P-256, candidate 876 of the same run also gives a prime-order curve of the right size. P-224’s run passed over three such curves, and the ANSI example curves’ runs seven more. Anthropic does not know what criteria were used, or whether this was an accident.
It judges weakened curves implausible because the number skipped is small, yet it adds that it is “still conceivable” that curves were chosen for a specific property by searching over timestamps. Nothing in the numbers shows how many runs there were. One binary-curve seed, B-163, remains unexplained, and the base points for P-224, P-256, P-384 and P-521 are not accounted for.
Security perspective: two readings
Supporters of the curves would say a plain, reproducible explanation leaves little room for subversion. Cautious readers would say that explaining how a seed was generated does not on its own prove that no candidate was filtered. Both views fit what Anthropic published. The company also says it will donate the $36,864 bounty for finding the seeds to the Internet Security Research Group. This is Anthropic’s own research, and I have not seen independent confirmation in the material I read. Systems that rely on P-256 should follow official guidance; for a wider security reading, see our report on Echo Frontier and zero-day patching and quantum-secure networking.
My view on the P-256 mystery
As a writer, I feel this is a satisfying piece of detective work, and publishing the code so anyone can check it is the right way to do it. I also think it would be unfair to treat either side as settled. A reproducible origin story is reassuring, and the open questions Anthropic itself lists are a reminder that trust in cryptography comes from many checks over time, not one discovery.
FAQ: NIST P-256 seed origin
Is P-256 broken?
No. Anthropic says the finding is not a cryptographic break, new attack or weakness in the curves.
Where did the seed come from?
Anthropic says it came from the lrand48 random-number generator seeded with a 1997 Unix timestamp, taking 1,842 iterations to produce the P-256 seed.
What is still unexplained?
Anthropic lists skipped candidate curves, the B-163 seed, and the base points for P-224, P-256, P-384 and P-521.