Claude reveals ECDSA curve origins

Anthropic used its Claude model to resolve a 25-year mystery about how the standard ECDSA curve seeds were generated: they are not hashes but outputs of the C library linear congruential generator lrand48 seeded with Unix timestamps (srand48(time)). Claude detected a telltale pattern of zero top bits, slid a scanner along each published seed testing 34 PRNG/output combinations, and recovered 48-bit internal states by brute-forcing hidden bits and using LLL lattice methods for truncated outputs. The recovered states step back to srand48 initial forms whose low 16 bits are 0x330E, and yield timestamps in May 1997-April 1998 for the prime curves (example: P-256 is candidate 1842 and required 1,842 iterations) and April 17, 1998 for several binary curves (their raw reads suggested February 1984, apparently doubled). Claude also reproduced code to generate candidates.

The findings are not a cryptographic break; instead they make deliberate subversion less plausible because the seeds are reproducible outputs of a weak, clock-seeded PRNG. Claude also explained the origin of some base points: several May 1997 curves (P-192 and several ANSI example curves) come from the FreeLIP long-integer PRNG seeded with small integers (e.g., 20000, 20420, 20507, 20509, 20512, 20517). Unexplained items remain: one binary seed (B-163) and the base-point selection for P-224, P-256, P-384 and P-521, plus some skipped viable candidate curves whose selection criteria are unknown. The discovery closes much speculation while leaving a few open questions.