Claude Traces NSA Crypto Seeds in Under 30 Minutes

Claude’s seed matches can be reproduced

Daily Crypto Briefs reran the short reproduction procedure published with the announcement. The outputs matched all five listed NIST prime-curve seeds, including the published P-256 value. This verifies that the disclosed inputs regenerate those numbers; it does not independently establish the original operators’ intentions.

For P-256, the procedure starts with August 16, 1997, at 01:52:34 UTC and produces the standardized seed at candidate 1,842. Each candidate consists of 20 output bytes. The check therefore reproduces a particular public value from a particular historical clock setting and iteration count.

The other matching cases were P-192, P-224, P-384 and P-521. Their supplied iteration counts ranged from 139 to 7,026. Reproduction does not require access to an NSA computer, a wallet or a blockchain account. It is a calculation using published inputs.

The older record explains why that calculation attracted attention. In his September 2023 investigation, researcher Steve Weis described attempts to establish who supplied the numbers and how they were chosen. He reported that standards author Alfred Menezes identified NSA mathematician Jerry Solinas as the person who contributed the seeds.

Weis also documented unsuccessful records requests and recollections that the seeds had been produced by hashing a humorous phrase. That account provided a search direction, but recollections were not a reproducible generation recipe. His page now links the new timestamp explanation.

The distinction is significant for scrutiny of shared security standards. Publishing a number lets others use it; explaining a repeatable process for obtaining it gives researchers another way to examine its provenance.

NSA curve controversy produced a $36,864 bounty

Cryptography engineer Filippo Valsorda’s October 2023 bounty announcement offered $12,288 for the five seeds’ origins, tripled to $36,864 if donated to an eligible charity. The challenge targeted historical parameter selection, not cryptocurrency balances.

Valsorda explained that the curves appeared in the digital-signature standard published in 2000. P-256 and P-384 also supported widely used web certificates. Their relevance extended well beyond cryptocurrency, making a small set of unexplained numbers a broad internet-security question.

His post listed the target seed values and emphasized that deriving parameters from a seed did not explain where the seed itself came from. An observable calculation can be checked even when its starting input remains unexplained. That was the gap the bounty sought to close.

Suspicion also developed against a separate standards controversy. NIST’s June 2015 announcement formally removed Dual_EC_DRBG from its random-number guidance after concerns about a possible exploitable weakness.

That action concerned a random-number generator, not an instruction to abandon every elliptic curve. NIST retained three other algorithms and described changes intended to strengthen implementations. The historical record makes precise identification of the affected component essential.

For crypto users, the word “seed” adds another possible source of confusion. The Bitcoin developer wallet guide describes how wallet software uses private keys to authorize spending and how deterministic wallets derive related keys from parent material.

A wallet recovery phrase belongs to that secret-key system. A curve seed is instead an input used to select common mathematical parameters. Reconstructing a published design input does not supply the secret needed to sign someone else’s transaction.

The wallet guide also separates signing from network access. A signing-only wallet can keep private material apart from the program that monitors the blockchain and broadcasts transactions. That division addresses exposure of a user’s secrets, rather than uncertainty about the public curve design everyone uses.

Encrypting a wallet file protects stored private keys when they are not in use, the guide explains. It cannot by itself prevent malware from capturing keys after decryption. Confidence in shared parameters and protection of a particular device therefore answer different security questions, even when both are described as cryptography.

Bitcoin uses secp256k1, with quantum work separate

Bitcoin’s BIP-340 specification states that its traditional ECDSA signatures use secp256k1 and defines Schnorr signatures over the same curve. P-256 and secp256k1 are distinct curves, despite both involving 256-bit mathematics.

BIP-340 deliberately retains Bitcoin’s existing curve and hash function while changing the signature scheme. That preserves existing key-selection mechanisms. Its design illustrates why a headline about ECDSA needs both a named curve and a clearly identified operation before its effect on Bitcoin can be assessed.

The specification defines 64-byte Schnorr signatures and exact verification behavior. In a consensus system, participants must agree on whether a transaction’s authorization is valid. A historical explanation for another curve’s origin neither rewrites those verification rules nor changes which keys can authorize spending.

The Bitcoin Core secp256k1 library implements signing, verification and key generation, alongside optional Schnorr support. Its documented safeguards include constant-time secret-key operations and derandomized ECDSA signing. These implementation questions are separate from the origin of NIST’s public parameters.

Future quantum resistance is another distinct issue. NIST’s post-quantum program addresses machines that could eventually undermine widely used cryptographic systems. Explaining how an old curve was selected does not replace the need to assess those systems’ mathematical assumptions.

That longer migration question remains the focus of Coinbase’s Bitcoin readiness discussion, rather than a consequence of recovering historical timestamps.

Broader sentiment eased: Alternative.me’s Fear & Greed Index read 55 on October 17, compared with 63 the previous day. The sentiment measure does not evaluate signature security.

Source: Alternative.me, checked around 18:05 UTC on October 17.

Anthropic has not explained every parameter choice. Further reproduction and cryptographic review can test the remaining questions, while the reported finding leaves Bitcoin’s signing rules unchanged.