Some mysteries call for a safe. This one called, among other things, for somebody to remember an office joke. For years, the origins of certain numbers fundamental to cryptography were sought in phrases that might have mentioned two colleagues and a pay rise. The documents had preserved the numbers. Human memory, apparently, had not preserved the recipe.
On October 16, Anthropic announced that an internal research model had found, in under half an hour, the origins of the seeds for P-192, P-224, P-256, P-384 and P-521: outputs from lrand48, a pseudorandom generator initialized with Unix timestamps. The company published code to reproduce them. The discovery does not break ECDSA; it clarifies where its parameters came from.
The appeal of the story lies in that shift. The question was not how to force a lock, but who had chosen its dimensions, with which tool and for what reason. In cryptography, a design can be public and still have an incomplete biography.
The numbers were in plain sight
ECDSA is a digital signature algorithm. Signing, in this context, helps establish where data came from and detect changes, functions described by the NIST signature standard. You do not need to follow the algebra to understand the concern: different people need to use the same mathematical rules, and the choice of those rules deserves an explanation.
Elliptic curves supply part of that common ground. Their parameters are public; each user’s private key is a separate matter. Confusing the two turns a historical investigation into a headline about exposed passwords, when nothing of the sort has happened. Knowing how a shared parameter was selected is not the same as discovering an individual user’s secret.
The FIPS 186-2 standard, published in 2000, records the curves and their seeds. A seed, in this context, is a starting value used in constructing the parameters. Publishing it makes later stages of the recipe checkable. An earlier stage remains missing, however: why start at that particular value?
The distinction is clear in RFC 4753, a 2007 document authored by D. Fu and J. Solinas. Its description of the 256-bit group provides a seed and says the choice was verifiable from it, using SHA-1. The document records the transformation, without telling the story of where that starting point came from. Doubt found room in the gap between a verifiable operation and an explained choice.
The joke that became a lead
In his investigation published in 2023, researcher Stephen Weis assembled recollections, documents and unanswered questions. Alfred Menezes, who worked on the ANSI X9.62 standard, confirmed to him that the NSA’s Jerry Solinas had supplied the seeds in 1997. That helped establish the numbers’ institutional route, but still did not explain how they were made.
The most appealing version involved running a humorous phrase through a hash function. Messages from Solinas later collected in this history suggested possibilities involving Bob and Jerry deserving a raise or being the best. The account itself carried caveats: the exact wording and procedural details had been lost. Solinas died in 2023.
The lead’s narrative power is easy to see. A forgotten joke would explain mysterious numbers associated with an intelligence agency. It was specific enough to guide attempts and vague enough to accommodate countless variations. But a good story can also narrow a search too far. A recollection does not become documentation just because it is memorable.
A bounty and several assumptions
Curiosity acquired a financial incentive. In October 2023, cryptographer Filippo Valsorda announced a bounty that reached $12,288, or $36,864 if the recipient chose an eligible charity. The challenge was presented as a search for the inputs believed to have produced the five seeds.
The announcement also captures the prevailing hypothesis. It discusses counters, punctuation, names, formats and possible repeated hashing. In this kind of search, a nearly correct phrase is still wrong. Changing a detail means testing another possibility.
Valsorda already rejected the idea that the missing origin story was enough to demonstrate a trap. The bounty sought to fill an uncomfortable gap, rather than remedy an intrusion in progress. An important distinction therefore predated Claude’s arrival: wanting a better explanation does not require believing the most frightening version available.
The clue was in the tool
The name lrand48 seems an unlikely fit for the ending of a thriller, but it belongs to a well-documented family. The Linux C library manual describes a generator that updates a 48-bit numerical state according to a fixed formula. Its initialization function, srand48, combines the supplied value with predefined bits.
“Pseudorandom” matters: the sequence follows rules. Knowing the mechanism and its starting point allows the path to be retraced. That makes the tool interesting for an investigation into origins, without turning every use of randomness into a solved problem. The target here is a public sequence already preserved in specifications.
The investigation changed its question: what program could have left those numbers behind? According to the company, Claude looked for traces of old generators, recovered their state and worked back to initialization.
According to Anthropic, the P-256 seed corresponds to candidate 1,842; apparently viable candidates were skipped for unknown reasons. B-163 remains unexplained, as do the base points for P-224, P-256, P-384 and P-521. The announcement credits the model and the company’s team; this article did not independently reproduce the results.
Those gaps prevent the case from becoming a universal certificate of security. They also give the discovery a more interesting scope than a promotional demonstration: there is a verifiable proposal to answer a specific question, and there are questions that survive it.
The story ends better that way. After so much searching for the perfect phrase, the investigation found an ordinary tool. The mystery has shrunk. The obligation to explain choices, especially when millions of people depend on them, remains intact.
