For 25 years the cryptographic community wondered about the provenance of the SEED values published alongside the NIST elliptic curves in the FIPS 186-2 standard. These seeds determine the curve coefficient b through a hash function, yet the NSA provided them without any explanation of their origin.
Early speculation suggested that long-time NSA employee Jerry Solinas had produced the seeds by hashing humorous internal phrases such as “Give Bob and Jerry a raise.” That theory remained unverified after Solinas’s death in 2023.
Claude identifies the true source
Engineers at Anthropic asked the internal research model Claude to investigate without supplying the old rumor. Within minutes the model recognized that the published seeds matched output from the lrand48 generator in the C standard library, initialized with Unix timestamps.
The generation process worked as follows: the generator was seeded with a Unix time t, then 20-byte candidates were extracted every 20 calls. The published seed for NIST P-256 corresponds to the 1842nd candidate produced on 16 August 1997 at 01:52:34 UTC. Similar timestamps between May 1997 and April 1998 account for all five prime-field curves.
Base points also traced
Base points for six curves created in May 1997, including P-192 and several ANSI X9.62 examples, were generated by the random routine inside FreeLIP, Arjen Lenstra’s long-integer package. The starting seeds for that generator (20000, 20420, etc.) have now been recovered and reproduce the published points exactly.
Implications for trust
The discovery shows that the curves were chosen by a weak, publicly reproducible process rather than by any sophisticated backdoor insertion. While a few valid candidate curves were skipped and one binary-field seed remains unexplained, the overall methodology leaves far less room for hidden weaknesses than previously feared.
The full reproduction code, written in Python, has been released under CC0 and confirms every recovered seed and base point.
