NIST Elliptic Curve Seeds: How the Mystery Was Solved

The NIST elliptic curve seeds, a set of unexplained numbers behind much of the signing that secures websites and software, now have an explanation. As of 16 October 2026, a team at Anthropic reports that the seeds were not hashes of a hidden phrase, as long rumoured, but outputs of an ordinary 1990s random number generator started from the clock. This piece answers that news item, which we saw on 15 and 16 October 2026. The finding is not a break of any encryption. What it changes is how much trust a public standard has to ask for.¹

What are the NIST elliptic curve seeds?

Elliptic curve cryptography, used for digital signatures such as ECDSA, needs every user to agree on one curve, a fixed set of numbers that defines the maths. NIST, the US standards agency, published five such curves over prime fields, named P-192, P-224, P-256, P-384 and P-521, in FIPS 186-2 in 2000². The cryptographer Filippo Valsorda notes that the NIST curves, especially the NIST P-256 curve and P-384, are the ones used by the ECDSA certificates that secure much of the web.²

Each curve came with a seed, a number from which the curve's coefficients were derived by hashing. This method, set out in a standard called ANSI X9.62, is called generating a curve "verifiably at random": if the numbers come out of a hash, nobody could have tuned them by hand.² That only reassures if you know where the seed itself came from, and for these curves that was never published. Valsorda's 2023 bounty post says the seeds were provided by the NSA and generated in 1997 by Jerry Solinas, who died in early 2023.²

Why did the unexplained NIST curve seeds worry cryptographers?

Because of a precedent, a suspected elliptic curve backdoor in another NIST standard. NIST published a random number generator called Dual_EC_DRBG in 2006. It used two fixed points on an elliptic curve, and whoever knew a secret link between them could predict its output. The second point had not been generated verifiably at random. In September 2013, NIST strongly recommended against using Dual_EC_DRBG³ after reports based on documents leaked by Edward Snowden, and it removed the generator from its draft guidance on 21 April 2014.³ The lesson many drew was that a constant without a documented origin is a risk, whatever the intent behind it.

Daniel Bernstein and Tanja Lange turned that lesson into a test they call rigidity on their SafeCurves rigidity page (https://safecurves.cr.yp.to/rigid.html). A curve is "manipulatable" if its generation involves a large unexplained input, because a malicious generator could try many seeds until one produced a curve weak to a secret attack. They list NIST P-224 as manipulatable because its coefficients come from hashing an unexplained seed.⁴ The page frames this as a gap in assurance and a hypothetical, not as a known attack. It is worth being clear about what the worry was not: nobody had shown a weakness in these curves.

How were the NIST curve seeds generated?

The Filippo Valsorda bounty began on 5 October 2023, when he and other contributors offered $12,288, tripled to $36,864 if the winner gave it to a US charity, for recovering the inputs behind the five seeds. The working theory, which the post presents as an allegation, was that the seeds were SHA-1 hashes of English sentences that Solinas later forgot.² Nobody claimed it for three years.

On 15 October 2026 a team from Anthropic, the company that makes the Claude models, claimed it. Their account is that the seeds are not hash outputs at all. They come from the C library's lrand48 generator, started with a Unix timestamp, which produced 20-byte candidates that were each tested against the ANSI X9.62 rules. The published P-256 seed was candidate 1842, from a run started at 01:52:34 on 16 August 1997¹.¹ Anthropic says Claude spotted a pattern of zero bits in some seeds that would arise by chance about once in 5,810 cases, which pointed to a weak 1990s generator, and finished the work in under half an hour.¹

Because Anthropic is both the claimant and the maker of the tool, independent checking matters. Valsorda, who ran the bounty, wrote that he reimplemented the algorithm in Go to verify it.⁵ Read the original reports in Valsorda's bounty-claimed post (https://words.filippo.io/seeds-solved/) and Anthropic's ECDSA curve origins note (https://www.anthropic.com/research/ecdsa-curve-origins).

Does this rule out a backdoor in the NIST P-256 curve?

Anthropic states plainly that this is not a cryptographic break or a weakness in ECDSA. Its argument is that a simple, reproducible process makes a deliberate weakness less plausible than an opaque one.¹ Valsorda puts a number on it. A technique Bernstein and Lange described in 2017 assumed about 70 bits of freedom, meaning roughly 70 independent yes-or-no choices for whoever generates the curves, to target a hypothetical class of 2^61 weak curves. He finds the seed selection left barely 30 bits of freedom⁵, too few to aim at weak curves.⁵ By our own arithmetic, 30 bits is about a billion options, while 70 bits is a billion times a trillion.

What is still not known, and who might disagree?

Several pieces are missing. Valsorda reports that the search yields roughly twice as many valid seeds as were published, with no good explanation, and one acceptance rule is still unidentified.⁵ Anthropic adds that the B-163 seed and the base points of P-224, P-256, P-384 and P-521 remain unexplained, and that some valid candidates were skipped: for P-256, candidate 876 also gives a valid curve, but 1842 was published. The authors say they do not know the selection criteria, and that too few candidates were skipped to suggest weak curves were being picked.¹

A fair sceptic can make three points. Knowing how a number was produced does not show why that one was picked. The person said to have chosen the seeds can no longer be asked. And the account so far rests mainly on one team's work plus one reimplementation. Valsorda, for his part, writes that this completes a rehabilitation of the NIST curves,⁵ but that is his judgement, not a settled consensus. This piece is background, not security advice, and Anthropic itself says there is no action to be taken.

Standards have moved on in any case. In February 2023 NIST kept the older curves in its elliptic-curve standard, SP 800-186, and added two newer Edwards curves.⁶ The same month it issued FIPS 186-5, which replaced the 2013 signature standard.⁷

What does this show about trust in public standards?

Money offers a useful comparison. As we explain in What Is Money and Why Does It Work? (https://therealigned.com/story/what-is-money-and-why-does-it-work), money works because people accept it, and acceptance rests on trust. A cryptographic standard works the same way: everyone adopts it because everyone else does, and few can check it themselves. Online payments, and the bank ledgers described in How Banks Create Money (https://therealigned.com/story/how-banks-create-money), rely in part on layers of such standards.

The incentives are also instructive. Public standards are public goods, usually paid for through taxes, a subject we cover in How Taxes Work: Who Really Pays? (https://therealigned.com/story/who-really-pays-taxes). When trust in one broke, as with Dual_EC_DRBG, part of the repair came from outside the agency: a privately funded prize, matched by a handful of contributors, that drew an answer for a sum Anthropic says it will donate to the Internet Security Research Group.¹ The cheapest assurance a standard can offer is its own paperwork: how every constant was chosen, written down at the time.