Claude traces NIST curve seeds to lrand48
A $36,864 bounty was on the table for anyone who could explain the "random" numbers behind NIST curves, and Claude got there in under thirty minutes. Those values, handed over by the NSA in 2000, are what P-256 and its siblings rely on for HTTPS, passkeys and payments. Where they came from had stayed a mystery, and the NSA engineer tied to them died in 2023. Claude's guess: a 1990s C random number generator. So it wrote a scanner, ran 34 combinations, and caught a pattern sitting at a one in 5,810 chance of being random. That trail led to lrand48, seeded with Unix timestamps from 1997-98. So the "mystery numbers" under the internet's hood came out of an ordinary random number generator plus a clock. No backdoor turned up, which makes the idea that the NSA weakened the curves look a lot less likely. The bounty heads to the nonprofit behind Let's Encrypt, and Anthropic published the research on ECDSA curve origins here: http://anthropic.com/research/ecdsa-curve-origins
