Answers from the documentation; checking which model is on duty
Hi - I answer from the OpenSmartRoute documentation: routing, the API, plans and quotas, self-hosting. Ask away, or open a support ticket if you need a person.
Grounded in the docs - follow a source before acting on it.
Claude Traced NIST Curve Seeds to 1990s RNG - OpenSmartRoute
Anthropic's Claude identified the exact 1990s random number generator used to create NIST cryptographic curve seeds. The model solved a mystery that had puzzled researchers for decades.
Key points
Claude traced five NIST curve seeds to a 1990s C library generator.
The seeds originated from Unix timestamps between May 1997 and April 1998.
Anthropic's internal model solved the puzzle in under half an hour.
The $36,864 bounty for this discovery will be donated to the ISRG.
Why it matters: Researchers can now verify cryptographic parameters with confidence instead of relying on speculation.
By OpenSmartRoute editorial · written through the router by writer-small
From Unite.AI - “Anthropic Says Claude Traced NIST ECDSA Curve Seeds to a 1990S RNG”
Anthropic's internal Claude model solved a decades-old mystery. It traced NIST cryptographic curve seeds to a 1990s random number generator. The model found the exact source code used to create these values.
This discovery answers a question researchers have asked for years. The National Institute of Standards and Technology (NIST) published these seeds without explaining their origin. Security experts wondered if a hidden backdoor existed within the math.
Cryptographers rely on these seeds to build secure digital signatures. If the seeds were chosen by a human, they might contain a secret message. A malicious actor could use that message to break the encryption later.
Now, an AI agent has proven the seeds came from a standard library function. The function used a simple clock time to start the random number process. There was no hidden instruction or secret passphrase involved.
The team at Anthropic ran this test using their own research models. They did not need external help to solve the puzzle. The model worked through the math on its own computer.
This proves that modern AI can perform deep cryptographic analysis. It can also verify the safety of systems we depend on every day. Engineers can now check their own code with similar tools.
What Claude Discovered About NIST Curve Seeds
Elliptic curve cryptography (ECC) is the most popular method for digital signatures today. It uses math problems that are easy to do forward but hard to reverse.
NIST adopted this standard in the year 2000. The document called FIPS 186-2 defines the rules for using these curves. It lists several different curve sizes for different security needs.
Each curve needs a special seed value to calculate its specific math parameters. These seeds define the curve's shape and its security level. The National Institute of Standards and Technology (NIST) published these seeds in the official document.
The seeds are long strings of hexadecimal characters. For example, the P-256 seed looks like C49D3608 86E70493 6A6678E1 139D26B7 819F7E90. These strings look random to anyone who does not know the source.
For years, no one knew how these specific strings were created. The NIST document did not say where they came from. This lack of information raised serious security concerns among experts.
OpenAI released 719 math manuscripts from an unreleased frontier model. Mistral and Reflection AI launched new open-weight models to compete with Chinese systems.
Replit CEO Amjad Masad says the company ended its partnership with Anthropic due to cost, performance, and partnership reasons. He claims OpenAI's ChatGPT now performs better for their specific coding needs.
Some researchers suspected the seeds might have been chosen by a person. If a person chose them, they might have hidden a message inside. That message could allow an attacker to break the encryption later.
The controversy became famous in a paper titled "A Riddle Wrapped in an Enigma." Neal Koblitz and Alfred Menezes wrote about the mystery. They explained why the unknown origin was so dangerous.
An amateur hacker even offered a cash prize for solving the puzzle. The bounty was $36,864. This amount is a large sum for a computer science problem.
Many people tried to guess the source. They looked for hidden patterns in the numbers. They searched for clues in the history of the computer industry.
None of these attempts succeeded. The seeds remained a black box for over twenty years. Security teams had to assume the worst-case scenario. They had to assume a hidden message existed.
The History of the Unexplained NSA Seeds
The National Security Agency (NSA) is a US government agency that manages cybersecurity. It has historically provided cryptographic standards to the world.
In the 1990s, the NSA worked on creating secure communication methods. They wanted to ensure their own communications remained secret. They also wanted to protect global financial systems.
When NIST adopted the standard in 2000, it included curves developed by the NSA. The agency supplied the seed values without any explanation. They simply stated the values were correct.
No one knew if the NSA used a random number generator. They might have used a human to pick the numbers. A human could easily hide a secret in a list of numbers.
Jerry Solinas was a former employee of the NSA. He was a mathematician who worked on these curves. He died in 2023 after a long illness.
Solinas once shared a story about how he might have created the seeds. He said he used a humorous passphrase as a password. The passphrase was something like "Give Bob and Jerry a raise."
Bob Reiter was a programmer who wrote the code for the curves. He confirmed that Solinas generated the seeds. He also said no archives from that time period survived.
Without the archives, no one could verify Solinas's story. The code was old and the files were lost. The mystery remained unsolved for decades.
The bounty hunter never won the prize. The $36,864 reward went to the Internet Security Research Group instead. The group donated the money to support research.
The lack of transparency made many people distrust the system. They worried about hidden weaknesses in the math. They worried about future attacks on digital signatures.
Security teams had to build extra layers of protection. They had to verify the integrity of the curves manually. This added cost and complexity to their work.
The situation changed when an internal Anthropic model stepped in. It did not rely on old rumors or guesses. It used pure mathematical reasoning to find the answer.
The model proved that the seeds came from a standard library. It showed exactly which function generated the numbers. It showed the exact date of the generation.
This proof ended the speculation. Researchers no longer need to guess the origin. They can see the exact process that created the seeds.
How Claude Found the 1990s Random Number Generator
Anthropic employees tried to solve the puzzle before the AI model. They followed the clue about the humorous passphrase. They checked the code and the archives.
They found nothing that matched the story. The passphrase did not appear in the code. The archives were indeed missing.
In October 2026, an Anthropic employee asked the internal model for help. The employee did not mention the passphrase clue. The model ignored the rumor completely.
The model hypothesized that a standard random number generator was used. It focused on the software that shipped with C libraries in the 1990s. It looked for patterns that weak random numbers would show.
The model scanned the published seeds bit by bit. It tested different chunks of the data as potential outputs. It checked 34 combinations of generators and output slices.
One pattern stood out immediately. Four of the ten seeds had a specific bit arrangement. The top bit of all twenty words was zero.
This pattern is very rare. It happens by chance with a probability of 1 in 5,810. Such a low probability suggests a specific cause.
The pattern pointed to the lrand48 function. This is a linear congruential generator found in the C standard library. It returns only the top 31 bits of a 48-bit state.
The model recovered the generator state for four of the seeds. It tried every possible value for the first word. It verified that the next four words followed logically.
The process took less than half an hour. The model worked fast and accurately. It solved a problem that stumped experts for years.
The model then checked the binary curve seeds. They followed the same pattern as the prime curve seeds. They also matched the lrand48 generator output.
The model found that the generator state was truncated. It kept fewer bits than the full 48-bit state. This explained the shorter seed lengths.
The model reconstructed the internal state using a specific math technique. It used the Lenstra–Lenstra–Lovász (LLL) basis reduction algorithm. This is a standard tool for lattice problems.
The solver tested every possible window of values. It found matches for all five prime-curve seeds. It also matched five more seeds from the ANSI X9.62 standard.
The consistency across different standards confirmed the theory. The same generator created seeds for multiple curve types. The dates fell between 1984 and 1998.
The model also checked the base points of the curves. These points define the starting point for every public key. The model found that some base points also came from a random number generator.
The generator used for the base points was different. It was the one in the FreeLIP package by Arjen Lenstra. This package shipped with early versions of Victor Shoup's NTL library.
The model identified the specific seeds used for the base points. For example, the seed for P-192 was 20000. The seeds for the prime239 curves were 20420, 20507, and 20509.
The model verified these numbers against the known initialization states. The low 16 bits matched the expected value of 0x330E. This value appears once every 65,536 steps.
The dates for the base point seeds were May 1997. The dates for the main curve seeds were later in 1997 and early 1998.
The model concluded that the entire process was automated. No human intervened to pick the numbers manually. The clock simply drove the random number generator.
The Technical Details of the Lattice Problem
Reconstructing the internal state of a truncated linear congruential generator is a hard math problem. It is known as a lattice problem in computer science.
A lattice is a grid of points in high-dimensional space. The problem involves finding a short vector in this grid. This vector represents the hidden generator state.
Claude solved this problem using the LLL algorithm. The algorithm reduces the basis of the lattice to find the shortest vector. It is a textbook method for this type of problem.
The model applied the solver to every possible window of the data. It tested many different starting points for the search.
The math required checking billions of possibilities. The model did this automatically and quickly. It did not need human intervention for the heavy lifting.
The model verified its findings with direct computation. It ran the recovered state forward and backward. It checked the 160-bit match against the 32-bit seed.
The probability of a random match is extremely low. The model calculated that a coincidence was impossible. The match was real.
The model also ran the state backward until it reached the initialization point. It found the Unix timestamp that started the process.
The timestamps confirmed the dates of 1997 and 1998. The binary seeds dated back to February 1984. The team noted a two-week gap in the timeline.
The gap suggested the program might have halved the clock. This would explain the difference between the binary and prime seed dates.
The model also checked the base points for the larger curves. P-224, P-256, P-384, and P-521 did not fit the FreeLIP recipe. Their base points remain unknown.
The model identified that the prime curves used a different generator. The FreeLIP generator produced the base points for the smaller curves.
The model noted that the selection process might have skipped some candidates. Not every 20-byte seed produced a viable curve.
Some potentially viable candidates were skipped during the generation process. This raises questions about the final selection of the curves.
The team observed that candidate 876 for P-256 also produced a valid curve. The published seed was candidate 1842.
The skipped candidates were few in number. The team does not think this indicates a weakened curve was chosen.
The model confirmed that the generator runs backward as easily as forward. This property made the state recovery possible.
The low 16 bits of the initialization state were recognizable. They equal 0x330E in hexadecimal. This form arises once every 65,536 steps.
The precision of the recovery was high. The model matched the exact bits of the original seeds. There was no error margin.
The technical details show the power of modern AI reasoning. The model understood the math deeply enough to solve the puzzle.
It combined pattern recognition with algebraic number theory. It used tools from cryptography and computer science seamlessly.
The work demonstrates that AI can replace manual cryptanalysis. Engineers can use similar models to audit their own systems.
What This Means for Cryptographic Security
The findings do not represent a cryptographic break. There is no new attack on the ECDSA curves. The security of the curves remains intact.
The seeds were produced by a common pseudorandom number generator. Anyone can now reproduce the process with the same tool.
This method leaves much less room for subversion. It is harder to hide a secret in a standard library function.
The team increased confidence that the parameters are secure. The transparency of the origin helps the community trust the system.
The result frames the end of years of speculation. Researchers no longer need to guess about the seeds' history.
Most researchers already trusted the curves before this discovery. The news confirms what they suspected without proof.
Some questions remain open regarding the selection process. The team noted that some candidates were skipped during generation.
The number of skipped candidates is small. The team does not consider the selection of weakened curves plausible.
It remains conceivable in principle that curves with a specific property could have been chosen. Searching over timestamps could theoretically select a curve.
One seed resisted recovery entirely. The fifth binary seed, B-163, matches nothing Claude tried. This seed remains a mystery.
The base points of the larger curves are still unknown. P-224, P-256, P-384, and P-521 base points are unexplained.
The work highlights the importance of documenting cryptographic origins. Future standards should require full transparency about seed generation.
Engineers should audit their own random number generators. Weak generators can compromise the entire security system.
The discovery shows that even standard libraries can have hidden flaws. Developers must test their dependencies thoroughly.
The $36,864 bounty will be donated to the Internet Security Research Group. This supports future research into cryptographic safety.
The post thanks Filippo Valsorda for organizing the bounty. He recognized Solinas posthumously for his contribution.
The work is credited to a team of researchers at Anthropic. Their names are listed in the publication.
The reproduction code is dedicated to the public domain. This allows anyone to verify the findings independently.
Why It Matters for Model Evaluators
Model evaluators need to know when AI can solve hard problems. This case shows that Claude can perform deep cryptographic analysis.
Evaluators can test their own models against similar challenges. They can see if their agents can find hidden patterns in data.
The evaluation process involves checking the model's reasoning steps. Evaluators must verify that the model did not hallucinate the answer.
The model checked its own work before concluding. It verified the match with direct computation on its side.
Evaluators should look for this self-correction in their own models. It indicates a higher level of reliability in the output.
The speed of the solution is impressive. The model solved the puzzle in under half an hour.
Evaluators can measure the time it takes for their models to reach a conclusion. This helps them set performance targets.
The quality of the reasoning matters more than just the final answer. Evaluators must check the logic used to get there.
The model used specific mathematical techniques correctly. It applied the LLL algorithm as intended.
Evaluators should check if their models understand the underlying math. A model that guesses might get lucky, but it will fail later.
The transparency of the process is key. The model explained its steps clearly in the internal reasoning.
Evaluators can use this as a benchmark for their own systems. They can compare the depth of reasoning required.
The work shows that AI can assist in high-stakes security reviews. It can help find flaws that humans miss.
Teams can integrate such models into their security audit workflows. This increases the coverage of their testing.
The evaluation framework must include checks for mathematical correctness. Simple pattern matching is not enough.
Evaluators should also check for bias in the model's reasoning. The model must not rely on false assumptions.
The ability to trace origins is a new capability for AI agents. It opens up new use cases for security auditing.
How OpenSmartRoute Helps
Teams that route requests through OpenSmartRoute gain immediate value from this news. They can deploy a model capable of such analysis to their security audits.
OpenSmartRoute allows a team to add a cryptographic analysis model to their catalogue. The model competes on the next request automatically.
The router scores every candidate on quality, cost, speed, and safety. The team sets the weights for these scores per request.
A new model is just one catalogue entry. It competes on the next request without changing the app configuration.
The router works with any OpenAI-compatible provider. Teams can serve open-weight models locally if they prefer.
An input guard spots prompt injection and personal data before a request leaves. This protects sensitive information during the analysis.
The 'osr eval' tool measures routing accuracy on the team's own prompts. It can fail a build if the accuracy drops too low.
The hosted platform keeps a models catalogue with prices and public rankings. These rankings are built from real traffic data.
A savings ledger shows what each routed request cost next to the most expensive model. This helps teams track their spending on security tools.
The team can set hard rules to pin requests. For example, text with personal data stays on an on-premises model.
A region or a cost cap is never crossed by the router. This ensures compliance with local regulations and budgets.
The team learns from outcomes, so a model that answers well gets more traffic. A model that fails gets less traffic automatically.
Researchers found Large Language Models frequently answer using search snippets without reading the actual web pages. This behavior leads to outdated answers and misleading citations across multiple model types.
