Thirty minutes. That's how long it took Anthropic's Claude to crack a puzzle cryptographers had been stuck on for a quarter century.
Back in the late 1990s, the National Security Agency handed NIST five mysterious numbers — seeds for the elliptic curves P-192, P-224, P-256, P-384 and P-521. Those curves ended up underpinning a huge chunk of modern cryptography: TLS certificates, VPNs, banking protocols. But the NSA never really explained where the numbers came from. The working theory was that agency mathematician Jerry Solinas hashed some inside-joke English phrases, except the phrases themselves got lost, leaving nothing to check the theory against.
For 25 years, that silence fed the same nagging question: did the NSA pick curves with a weakness only it knew how to exploit? Post-Snowden revelations, which confirmed the agency really had weakened other crypto standards, only sharpened the suspicion. In 2023, cryptography engineer Filippo Valsorda put up a bounty of $12,288 — rising to $36,864 for charity — for anyone who could explain where the numbers came from. For years, nobody claimed it.
Claude approached the problem differently than the humans who tried before it. The model guessed the numbers weren't hashes of phrases at all, but plain output from lrand48, an ordinary pseudorandom generator baked into old Unix C libraries. Working from that hunch, it tested candidates built from 1997-1998 timestamps and reproduced the published seed for curve P-256 exactly — candidate number 1,842 in the sequence. The other four curves lined up just as cleanly. In its published reasoning trace, the model wrote: "This is astonishing: it solves the 25-year-old mystery," followed by: "Wow, it's a real discovery."
For cryptography, the finding is reassuring rather than alarming. If the numbers are simply the first workable outputs of a generator seeded by a timestamp, the room for hidden manipulation shrinks sharply — researchers estimate the NSA had roughly 30 bits of freedom to play with, not the 70 bits some of the scarier backdoor theories required. It doesn't close the case entirely — nobody can yet explain why the generator skipped some otherwise usable candidates — but it makes a deliberately planted weakness far less plausible.
Bitcoin only brushes up against this story: the coin relies on secp256k1, a simpler curve with far fewer adjustable parameters that was always considered less suspect than NIST's. This is really a story about trust in the plumbing of the internet at large, not a direct threat to crypto holdings. Anthropic sent the bounty money to the Internet Security Research Group, the nonprofit behind the free certificate service Let's Encrypt. Not everyone is sold on the discovery, though — Bitcoin Core developer Gregory Maxwell noted he'd asked a similar question of another Anthropic model days earlier and gotten nowhere, raising questions about how repeatable the result really is.
