Claude reveals ECDSA curve origins

TL;DR Highlight

Claude found in under 30 minutes that NIST curve seeds came from lrand48 seeded with timestamps.

Who Should Read

A backend developer who works with crypto standards or random number generators and wonders whether LLMs can reverse-engineer code and math.

Core Mechanics

The seeds were lrand48 output, not hashes
- The NIST P-192, P-224, P-256, P-384 and P-521 seeds were not hash results.
- They were output from the C library's lrand48, seeded with a Unix timestamp.
- Each candidate took 20 bytes, and P-256's published seed was candidate 1,842.
Changing the approach solved it
- Searching for the rumored humorous phrase hash had come up empty.
- Claude guessed the software used a weak 1990s C library PRNG.
- It wrote a scanner that slid along each seed bit by bit, covering 34 generator and output-slice combinations.
Top bits being zero was the key clue
- Four of the ten seeds had a 0 top bit in all 20 words, a 1/5,810 chance.
- This matches lrand48, which returns only the top 31 bits of a 48-bit state.
- Claude tried all 2^17 hidden-bit values and recovered the state for four seeds.
Prime curves fell to an LLL lattice solve
- Prime-curve seeds kept fewer output bits, but recovering a truncated LCG state is a textbook lattice problem.

Community Reactions

Selection process is still unknown
- One commenter said the method is confirmed but discarded candidates are invisible, so selection criteria remain unknown.
- Another pointed out that the article's logic about disclosing timestamps fails, since staying silent would suffice.
B-163 may be a typo
- One commenter suggested it was generated the same way but a digit was mistyped when published, which is why no solution was found.
How to prompt an LLM to do this
- One commenter asked how one would prompt a general LLM to do this without an internal research model.
- Another shared an experience giving Opus 5.5 a hint that the first digit never exceeds 7, hinting at lrand48's 31-bit output, and watching it work through it.
Concern about model access gap
- One commenter worried that Anthropic can do this work while ordinary users get blocked, widening a moat between providers and the public.
- They argued only open model progress bridges that gap.

How to Apply

Audit random number usage in your code
- Spend 30 minutes today searching your repo for rand, lrand48, srand48 and time-based seeds.
- List every place used for keys, tokens or passwords.
- Replace those with a cryptographically secure PRNG.
Give LLMs reverse-engineering problems as hypotheses
- For stuck problems, ask how the software of that era might have produced the data instead of asking for the answer.
- Attach any visible pattern, like top bits always 0, as a hint.
- Verify each hypothesis the model proposes with your own code.
Run the model's verification code yourself
- Run the article's published Python code to confirm the seeds reproduce.
- Judge model claims by whether the output matches.

Try It

copy & run

# Paste into Claude or ChatGPT chat (simplified version of the article's approach)

I want to find out what software generated the data below. Reversing a hash has already failed.

Data:
{{data (e.g., list of hex values)}}

Proceed in this order.
1. Propose 3 hypotheses for how software of that era (e.g., a PRNG in a contemporary C library) might have produced it.
2. Look for bit-pattern bias in the data (e.g., a bit that is always 0).
3. Write Python code to test each hypothesis.

Next step: run the code yourself and check the output matches the data; if it does, ask the model to work backward to the input (seed) that was used.

Terminology

lrand48An old Unix C library random number generator. It outputs only the top 31 bits of its 48-bit internal state.

LCG (linear congruential generator)A simple generator that computes the next value as the previous times a constant plus a constant, modulo something. Because the rule is so simple, part of its output can reveal the internal state.

LLL algorithmA mathematical algorithm that finds short basis vectors of a lattice. It was used to recover the hidden state of a truncated LCG.

SeedThe hash input that determines the curve coefficient b. For random generators, it is the starting state.

Base point GThe fixed point on a curve of which every ECDSA public key is a multiple.