An AI solved a 1997 NSA cryptography mystery in under half an hour

Every time your browser shows a padlock, there is a good chance a piece of mathematics called P-256 is doing the work. It is one of a family of elliptic curves (a kind of equation whose properties make it easy to lock data and practically impossible to pick the lock) that the US standards body NIST published around the year 2000. Bank cards, passkeys, phone secure chips and most HTTPS connections lean on them.

Each curve was built from a 'seed': a 160-bit number, fed into a hash function to produce the curve, so that anyone could check the curve really came from the seed. The catch: nobody ever explained where the seeds themselves came from. They were supplied in 1997 by the NSA (the US signals intelligence agency), and the official answer amounted to 'they are random'. That gap is exactly where suspicion grows. If you can choose the seed, the worry goes, you can try millions of them until you find a curve with a weakness only you know about.

On Friday 16 October 2026 Anthropic, the company behind the Claude AI models, published the answer. One of its staff asked an internal research model to work out how the seeds were generated. According to Anthropic, it cracked it in under half an hour.

There had been one human clue. In 2015 Jerry Solinas, the NSA mathematician linked to the seeds, recalled that they might have come from hashing a joke phrase, something like 'Give Bob and Jerry a raise' (Bob being the colleague who wrote the code). Neither could remember the details. Solinas died in 2023. Several Anthropic employees had tried hunting for the passphrase and failed, because, it turns out, the memory was wrong.

The model was not given that hint. It guessed that 1990s software would have used a weak, standard random-number generator, wrote a scanner to test for one, and spotted that the top bits of some seeds were all zero. That pattern matched lrand48, a function in the standard C library that keeps 48 bits of internal state but hands out only 31 of them. From there it recovered the hidden state, by brute force for some curves and with a classic lattice-reduction technique (LLL) for the others, and found that each generator had been started from a Unix timestamp (the computer clock counted in seconds).

The result, per Anthropic: the seeds for P-192, P-224, P-256, P-384 and P-521 all come out of lrand48. P-256's seed is the 1,842nd 20-byte output after the clock read 16 August 1997, 01:52:34. Four of the binary-field curves point to April 1998, apparently from a program that halved the clock value. The starting points of six curves trace back to the random-number generator of FreeLIP, a free maths library of the era.

The check: each recovered state regenerates all 160 bits of its seed exactly, and Anthropic published code that reproduces them. Filippo Valsorda, the cryptographer who in 2023 put up a public bounty for the seeds, wrote on 16 October that he reimplemented the method himself in Go and confirmed it. The bounty, tripled to $36,864 for going to charity, goes to the Internet Security Research Group, the non-profit behind Let's Encrypt.

Picture a lottery that has run for 25 years on numbers drawn by a government official, who swore the draw was fair but threw away the machine. Every so often someone asks: what if the draw was rigged? Then a detective notices the winning numbers have a faint fingerprint, works out which make of 1990s ball machine leaves that fingerprint, and rebuilds the machine. Switch it on at the right minute in August 1997, pull 1,842 balls, and out come the winning numbers, exactly.

That does not prove the official was a saint. It proves the numbers came from an ordinary machine, switched on at an ordinary time, rather than being hand-picked one at a time. It also leaves one awkward detail: the machine produced at least one other valid ticket earlier in the run, and nobody knows why that one was passed over.

The suspicion is not paranoia. In 2013 documents leaked by Edward Snowden indicated that the NSA had planted a backdoor in Dual_EC_DRBG, a NIST-standard random-number generator, and NIST withdrew it. Since then the unexplained curve seeds have been a standing reason some engineers preferred alternatives such as Curve25519, whose numbers were chosen in the open. The seed question was a famous, well-defined, decades-old open problem, which is why a bounty existed at all.

What is new is who solved it and how fast. This is the latest in a run of AI-assisted results on problems humans had stalled on, from maths conjectures to security flaws, which we have covered before. The usual caveats apply: the write-up comes from Anthropic itself, the model is an unnamed internal one, and the team of ten researchers credited on the post did the checking and framing. The difference here is that the answer is mechanically checkable: run the code, and the 160 bits either match or they do not. They match, and an outside expert has checked.

For your padlock: nothing changes. Anthropic says plainly that this is not a cryptographic break, a new attack or a weakness, and that there is nothing to do differently. Valsorda wrote that the findings reinforce confidence in the curves. If anything, a long-running doubt about the most used curves just got smaller.

Smaller, not zero, and the sceptics have a point. Some commenters argued that 'much less plausible' oversells it: what has been ruled out is a seed hand-crafted for a weakness, not every conceivable trick. And there are loose ends. The starting points of P-224, P-256, P-384 and P-521 are still unexplained, as is one binary curve's seed. The P-256 run produced another valid curve at attempt 876 that was skipped in favour of 1,842, and other runs skipped a handful more, for reasons nobody knows. Anthropic's view is that skipping so few candidates makes deliberate weakness-shopping implausible. That is reasonable, but it is an argument, not a proof.

For the rest of us the bigger signal is the method. A model looked at a cold case, formed a hypothesis about 1990s software habits, wrote the tools to test it, and handed back something anyone can verify. Point the same patience at other old, unexplained constants in software, or at fresh code, and you have a powerful auditor, for defenders and attackers alike. Disclosure: we use AI tools from several companies, including Anthropic's, to help produce this brief.