It took less than 30 minutes. That is how long an internal Anthropic research model needed to crack a puzzle that had stumped cryptographers for 25 years. For comparison, a human research team would likely have needed weeks for the same deduction, assuming they even landed on the right approach at all. The result, verified by CoinDesk and confirmed by Anthropic itself, marks one of the most notable moments at the intersection of artificial intelligence and digital security in 2026. The so-called Claude NSA elliptic curve mystery, the question of where the mysterious numbers inside the NSA-supplied cryptographic curves actually came from, is now considered largely solved.
The case concerns the NIST elliptic curves, the mathematical foundation underpinning much of the world’s encrypted communication, from banking apps to messaging services. Ever since the Snowden disclosures, suspicion lingered that the US National Security Agency might have built a hidden backdoor into these curves. Now, of all things, an AI model has delivered an answer that significantly weakens that suspicion.
Table of Contents
Key Takeaways
- An Anthropic research model from the Claude family solved the origin of the seed numbers for the NIST elliptic curves P-192, P-224, P-256, P-384, and P-521 in under 30 minutes.
- The seeds come from the simple random-number generator lrand48, seeded with Unix timestamps from 1997 and 1998.
- For curve P-256, the model exactly reproduced the published seed at the 1,842nd candidate.
- A bounty originally set at $12,288 by Filippo Valsorda in 2023, later raised to $36,864, goes to the Internet Security Research Group, the nonprofit behind Let’s Encrypt.
- Bitcoin is not affected by this issue, since it uses secp256k1, a curve that was not designed by the NSA.
What elliptic-curve cryptography is and why it matters
To understand the Claude NSA elliptic curve mystery, it helps to look at the basics. Elliptic-curve cryptography, or ECC, is a mathematical method built on specific curve equations. These curves make it possible to achieve very strong encryption with comparatively short keys. That efficiency is why ECC is so widely used, in HTTPS connections in your browser, in digital document signatures, and in many cryptocurrencies as well. For such a curve to be secure, it needs certain parameters: fixed numbers that define exactly how the curve looks. These parameters must not be randomly insecure, but they also must absolutely not be deliberately chosen so that someone already knows a weakness in advance. That is precisely the point where the problem now known as the Claude NSA elliptic curve mystery originated 25 years ago.
Why the seed numbers were so controversial
In 2000, the US National Institute of Standards and Technology, or NIST, adopted a set of elliptic curves supplied by the NSA. Each curve came with a so-called seed value, a number supposedly chosen at random to generate the curve’s parameters. The problem: nobody outside the NSA could ever explain where these seeds came from. There was no documented, traceable method. This lack of transparency might have gone largely unnoticed, had it not been for the Dual_EC_DRBG case. That NSA-co-developed random-number generator actually turned out to contain a backdoor and was later removed by NIST. After the Snowden disclosures, suspicion grew that the seeds of the NIST elliptic curves might also have been deliberately manipulated to give the NSA a secret advantage in breaking encryption. “A riddle wrapped in an enigma,” is how cryptographers Neal Koblitz and Alfred Menezes described it back in 2015 in their widely noted paper. Koblitz and Menezes examined the problem systematically but reached no conclusive answer. The question remained open, casting a shadow of doubt over much of the world’s encryption infrastructure.
How Claude solved the NSA elliptic curve mystery
The breakthrough ultimately did not come from a university lab, but from an Anthropic research model in the Claude family. The model was tasked with systematically working out how the known seed values could theoretically have been generated. In doing so, it found that the numbers originate from lrand48, a simple, by no means cryptographically secure random-number generator found in older C program libraries. The decisive detail was the seeding: the generators were apparently started using Unix timestamps from 1997 and 1998. Unix timestamps count seconds since January 1, 1970, which makes them a comparatively small, well-bounded set of numbers to search. That allowed the model to systematically test candidates.
The exact reproduction for P-256
The result was especially striking for curve P-256, one of the most widely used variants in the world. Here, the Claude model reproduced the exact sequence of the published seed, at the 1,842nd candidate tested. This precision is considered strong evidence that the proposed method genuinely matches the NSA’s original process rather than being a coincidental match.
The table below summarizes the key facts of the Claude NSA elliptic curve mystery:
| Aspect | Detail |
|---|---|
| Affected curves | P-192, P-224, P-256, P-384, P-521 |
| Model solving time | Under 30 minutes |
| Source of the seeds | lrand48 generator |
| Seeding | Unix timestamps from 1997 and 1998 |
| Match for P-256 | Exact reproduction at candidate No. 1,842 |
| Original bounty (2023) | $12,288 |
| Final bounty | $36,864 |
| Bounty recipient | Internet Security Research Group (Let’s Encrypt) |
The bounty and its history
That this mystery was pursued so intensely in public is also thanks to cryptography engineer Filippo Valsorda. In 2023, he put up a $12,288 bounty for anyone who could prove the origin of the NIST seeds. Over time, the sum rose to more than $36,000, tied to the condition that the winner donate it to a charitable organization. With the solution now confirmed by the Claude model, the $36,864 bounty goes to the Internet Security Research Group, the nonprofit behind Let’s Encrypt. Let’s Encrypt provides free encryption certificates for millions of websites worldwide and is considered one of the most important pieces of infrastructure for secure internet connections. The donation closes a fitting circle: money from solving an encryption mystery flows back into the encryption infrastructure of the open internet.
What the discovery means for users
Anthropic itself frames the finding carefully but clearly. The discovery makes a deliberately built-in NSA backdoor in the affected curves significantly less likely. Had manipulation been intentional, one would have expected a more complex, better-concealed process rather than a traceable, ultimately simple random generator seeded with timestamps from the late 1990s. At the same time, Anthropic stresses that not every question has been answered. It remains unclear how certain other curve parameters were originally selected. The Claude NSA elliptic curve mystery is therefore not entirely closed, but it is an important, if not final, piece in the long process of scrutinizing these standards. For practical use, the takeaway is clear and reassuring: users of the NIST curves do not need to change anything. Anyone who visits HTTPS websites, uses online banking, or relies on digital signatures built on these curves is not negatively affected by this finding, quite the opposite, confidence in the standards is strengthened.
Why Bitcoin is not affected by this
Given the cryptography angle, many readers naturally ask whether Bitcoin or other cryptocurrencies carry any risk here. The clear answer: no. Bitcoin uses secp256k1, a different elliptic curve from the NIST standards. This curve was not designed by the NSA and contains no NSA-supplied seed numbers. secp256k1 is built from a handful of fixed, publicly known numbers. According to experts, this simple structure leaves little room for a hidden weakness, since there are practically no dials anyone could quietly manipulate. Satoshi Nakamoto, Bitcoin’s pseudonymous creator, never publicly explained why this specific curve was chosen. Ethereum later adopted secp256k1 for its own infrastructure as well. The Claude NSA elliptic curve mystery therefore concerns exclusively the NIST standard curves, not the Bitcoin or Ethereum blockchains. This distinction matters to avoid confusion in the public debate.
The separate quantum computing question
Independent of this finding, Bitcoin remains exposed in the long run to a different risk: the development of sufficiently powerful quantum computers that could theoretically break elliptic-curve cryptography. Notably, another piece of tech news landed the same week: on October 16, 2026, Google announced that its Willow chip had cut error rates roughly 40-fold in one particularly computation-heavy step. These two developments, the resolution of the NSA curve mystery and progress on quantum chips, are not directly related, but together they illustrate just how fast the field of digital security is currently moving. The quantum computing question remains an independent, long-term risk that this particular finding neither resolves nor worsens.
Context: an AI model as cryptography detective
What stands out about this case is not just the result, but the path that led to it. That an Anthropic research model from the Claude family, explicitly not a model from OpenAI or Google, solved this decades-old mystery illustrates the potential of modern AI systems for complex, systematic research tasks. The task did not require creative theorizing in the classical sense, but methodical, patient testing of thousands of candidates in a short amount of time, a strength increasingly attributed to AI systems. For the cryptography community, this is a wake-up call: unsolved mysteries that occupied expert teams for years could in the future be tackled far more quickly with AI assistance. At the same time, Anthropic urges caution, since open questions remain around how other curve parameters were chosen. If you want to dig deeper into related AI-and-cryptography risk debates, see our coverage of Justin Drake’s warning on whether AI math could break ECDSA before quantum computers do.
Conclusion and next steps
The Claude NSA elliptic curve mystery impressively shows how a 25-year-old trust problem in cryptography could be largely resolved through methodical, AI-assisted analysis. The origin of the seed numbers in the lrand48 generator, seeded with timestamps from 1997 and 1998, makes a deliberate NSA backdoor less likely, without fully eliminating every remaining shred of uncertainty. For readers who use smartphones, online banking, or encrypted messengers, no action is required. The NIST curves remain in use, with no adjustments needed. Anyone interested in blockchain topics should also note: Bitcoin and Ethereum use secp256k1, a structurally different, independent curve, and are not affected by this mystery. As a practical next step, it is worth keeping an eye on quantum computing developments, since, unlike the now-solved NSA mystery, that remains an open, long-term challenge for the entire cryptographic infrastructure. Readers who want to go deeper can find solid starting points in the Koblitz and Menezes paper as well as in the publications from Anthropic and CoinDesk.
