Claude Uncovers a 25-Year-Old NSA Number Mystery in ‘Real Discovery’

Numbers supplied by the U.S. National Security Agency (NSA) in the 1990s, long suspected of concealing a cryptographic backdoor, have now been traced to a basic computer program. Bitcoin was never involved in the controversy, and its potential vulnerability to quantum computing remains unresolved.

An artificial intelligence model developed by Anthropic has solved a decades-old cryptography mystery by identifying the source of numbers the NSA provided to the U.S. government in the late 1990s. The numbers, which had raised suspicions of a hidden weakness, were generated using a conventional random-number program based on timestamps from 1997 and 1998.

The AI model reached its conclusion in roughly 30 minutes, solving a puzzle that cryptographers had spent approximately 25 years trying to unravel.

An unexplained cryptographic design

Elliptic-curve cryptography underpins much of internet security and is also used to safeguard Bitcoin wallets. The technology allows users to demonstrate ownership of a secret key without disclosing the key itself.

The mathematics behind it can be compared to a lock whose design is publicly available. Every user has a unique secret key, while the security of the system depends on the difficulty of breaking the underlying mathematical structure.

That raises an important question: who determined the mathematical parameters that everyone was expected to trust?

In 2000, the U.S. National Institute of Standards and Technology (NIST) approved a collection of elliptic curves supplied by the NSA. However, the agency did not disclose how it generated some of the numbers used to construct those curves.

Suspicion intensified after Edward Snowden’s disclosures revealed NSA efforts to undermine certain cryptographic protections. NIST eventually withdrew its recommendation for Dual EC, a random-number generator associated with the controversy.

The initial values, known as seeds, were publicly available, but the NSA never provided a clear explanation of how they had been selected. This fueled speculation that the agency had tested numerous possibilities before choosing values that might create a weakness it could secretly exploit. One theory suggested the NSA could have engineered a backdoor into systems relying on the affected cryptographic standard.

Cryptographers Neal Koblitz and Alfred Menezes explored the issue in their 2015 paper, A Riddle Wrapped in an Enigma. Menezes had contributed to the original standard and remembered receiving the seeds from NSA mathematician Jerry Solinas in 1997.

Security researcher Steve Weis spent years investigating the origins of the numbers, including submitting public-records requests in 2018. NIST responded that it had no relevant documentation, while the NSA eventually stopped responding. One possible explanation suggested that Solinas had derived the values from a humorous phrase he could no longer remember, prompting researchers to search through possible combinations of words.

In 2023, cryptography engineer Filippo Valsorda and other contributors established a $12,288 reward for solving the mystery. The amount would increase to more than $36,000 if the recipient donated the money to charity. Solinas had died earlier that year, leaving investigators to rely on historical accounts and mathematical analysis, without finding a definitive answer.

Claude identifies the source

The breakthrough came when an Anthropic employee asked an internal Claude research model to investigate the problem earlier this month, without telling it about the theory involving a forgotten phrase.

In less than 30 minutes, the model traced five NIST curve seeds to lrand48, a random-number generator available in older C software libraries.

Claude reconstructed the sequence used to generate P-256, a widely deployed elliptic curve, and discovered that its published seed matched the output at candidate number 1,842.

“This is astonishing: it solves the 25-year-old mystery,” the model stated in its recorded reasoning. It briefly questioned whether the result was genuine, noting that the bounty remained unsolved according to its existing knowledge. After examining the numerical pattern and its statistical likelihood, however, it concluded that the discovery appeared to be real.

The program can now be run by anyone seeking to reproduce the numbers originally supplied by the NSA. Anthropic said the finding substantially reduces the likelihood that the unexplained seeds concealed a deliberate weakness. However, researchers still do not fully understand why certain eligible candidates were skipped or how other elements of the curve parameters were determined.

The discovery also illustrates why predictable randomness can pose a serious security threat. If a cryptocurrency wallet generated its private key using lrand48, someone who could estimate when the key was created might reproduce it and gain access to the funds.

However, the NSA’s original seeds were public from the beginning, meaning there was no secret value to steal in this particular case.

Why Bitcoin is not affected by this discovery

Bitcoin was not part of the NSA seed controversy. Its wallets rely on secp256k1, an elliptic curve based on a comparatively straightforward equation.

Unlike P-256, which incorporates a 77-digit parameter associated with the unexplained seed-generation process, Bitcoin’s curve is defined using two small, fixed numbers. This leaves considerably less room for hidden choices in the curve’s construction.

Cryptographers have long regarded this simpler design as an advantage because it reduces the opportunities for someone to introduce a concealed weakness through unexplained parameter selection.

Bitcoin’s pseudonymous creator, Satoshi Nakamoto, never publicly explained the decision to use secp256k1, which had seen limited adoption before Bitcoin brought it widespread attention. Ethereum subsequently adopted the same curve, and Bitcoin retained it when the Taproot upgrade introduced a newer signature scheme in 2021.

Nevertheless, Bitcoin faces a separate potential threat from quantum computing. As CoinDesk reported earlier this year, a sufficiently powerful quantum computer could theoretically derive a private key from its corresponding public key, which may be exposed on the Bitcoin blockchain. This risk is independent of how the curve’s original parameters were selected.

Progress in quantum hardware continues to attract attention. Google said this week that its Willow quantum chip reduced errors by approximately 40 times in one of the computationally expensive operations that a future quantum attack could require.

Even so, researchers have not yet developed a quantum computer with the scale and reliability needed to crack Bitcoin’s cryptographic keys. The timeline for building such a machine remains uncertain.

No immediate changes required

Anthropic said in its blog post that users relying on the affected NIST curves do not need to take action following the discovery. The breakthrough instead provides a reproducible explanation for numbers that had remained mysterious for decades.

The investigation also comes with a charitable outcome. The $36,864 prize will be donated to the Internet Security Research Group, the nonprofit organization responsible for Let’s Encrypt, which provides free security certificates to websites.

About The Author