Anthropic Team Solves the 30-Year Mystery Behind NIST's Curve Seeds
Ten Anthropic researchers claimed the full bounty for solving the decades-old riddle of the NIST elliptic curve seeds on October 15, 2026, at 01:07:51 UTC. The solvers were John Wood, Henry de Valence, Ava Howell, Zack Voase, Lucy Sweet, Amir Omidi, Paul Crowley, Iain McGinniss, Nicholas Carlini, and Steve Weis Filippo Valsorda.
The claim closes the seeds bounty that Filippo Valsorda announced on July 6, 2023. The offer was $12,288 for cracking all five seeds, tripled if donated to charity. The claimants donated the prize to ISRG, the non-profit that operates Let's Encrypt. The donated value was tripled to $36,864 Filippo Valsorda.
The curves at issue are P-192, P-224, P-256, P-384, and P-521, published by NIST in FIPS 186-2 in 2000. The five seeds were selected by the NSA in the 1990s. That selection left no verifiable generation record. The answer was mundane.
According to the write-up, the seeds were generated as output of drand48, a basic random-number function in older C libraries, seeded with the then-current UNIX timestamp via srand48() in 1997-1998. A UNIX timestamp is simply a count of seconds, so the input space was small. A 48-bit library generator seeded with wall-clock time is a narrow search space for modern hardware, and timestamp recovery becomes brute force.
For practitioners, P-256 carries the most operational weight. It is a Weierstrass curve defined over the prime field GF(p) with cofactor h=1 and prime order n NIST SP 800-186. It is described as a pseudo-random curve defined over a prime field and as the most widely used elliptic curve NIST Crypto Club. It provides about 128 bits of classical security. The larger prime curves step up accordingly, with P-256, P-384, and P-521 providing respectively 128-bit, 192-bit, and 256-bit security NIST.
For deployment, the result changes no security estimate. No parameter changes. No code changes. Keys generated on P-256 do not become weaker because a seed starting value was found. The curve arithmetic stands on its own.
In my view, the value is elsewhere. It settles a trust question with mechanism rather than assurance. Nothing-up-my-sleeve numbers work only when the method is visible, like a magician showing empty hands. Here the method turned out to be srand48(time(0)) on a workstation in the late 1990s, reproducible once the right timestamp was tested. That is both reassuring and uncomfortable, with no hidden structure to exploit but a casual way to produce critical constants.
The broader context here is process maturity. Modern verifiable randomness uses multi-party ceremonies, hash transcripts, and rigid generation procedures to avoid this kind of retrospective hunt. The fact that a team could, nearly three decades later, recover UNIX timestamps and match all five seeds says less about cryptanalysis than about tooling, parallel search, and persistence. The bounty structure helped, with a fixed prize tripled for charitable donation focusing effort without creating a market for doubt.
The longer view here is optimistic. The internet still runs heavily on P-256 for TLS, code signing, and authentication flows that most users never see. Confirmation that its seeds came from a weak but honest generator, rather than from tuned manipulation, leaves that foundation intact. It also gives standards work a cleaner record to cite, with future curve selections able to point to this episode as the reason rigid, auditable generation is now table stakes.
