Claude Traced NIST's Curve Seeds to the 1990s. That Is Provenance, Not a Break.

The headline that moved through crypto Twitter last week read like a breach. Anthropic's Claude had, per the report, "reverse-engineered" the seed values behind NIST's elliptic curve standard — the prime curves sitting underneath TLS, WebAuthn, and a meaningful slice of enterprise hardware security modules. Within hours the paraphrase had hardened: NIST curves cracked, Bitcoin next. It was the four hundredth obituary for a chain that has never once asked NIST for permission. Here is what the report actually says. An AI model was used to guess the input strings that, when passed through SHA-1, produce the coefficient constants baked into FIPS 186. That is provenance research. It is not a break. It is not a backdoor. The gap between those three things is where the entire story lives, and almost nobody covering it is standing in that gap. Check the math, not the roadmap. To understand why a timestamp string matters, you need the construction. NIST's prime curves are not arbitrary numbers pulled from a hat. Each one is generated by taking a seed value, hashing it with SHA-1, and using the digest to derive the curve coefficients a and b. The seed is published. The hash is deterministic. Anyone can re-run it. This is the "nothing up my sleeve" principle — a design discipline that says: prove you did not cherry-pick a weak curve by showing that the parameters came from a neutral, reproducible source. NIST published those seeds for exactly this reason. The 1990s were a period when parameter generation was ad hoc and largely undocumented, and the standards body wanted a construction a skeptic could check without reposing trust. The seeds were printed in the standards documents and later carried into the FIPS 186 revisions. What was never published was the human-readable origin of each seed — the string a person typed into a hashing tool before the digest existed. For twenty-five years that origin has been an open question, and open questions in cryptography attract folklore faster than they attract scripts. The published seed, though, is only the hash input. It is not necessarily the string a human typed. If the original input was something like a date or a short phrase, you can recover it by guessing candidates and hashing forward until a digest matches. SHA-1 is not invertible, so there is no algebraic shortcut — only enumeration. That is precisely the shape of problem a language model with a large memorized corpus is good at proposing candidates for. Which brings us to the actual claim: Claude proposed input strings that resolve to 1990s-era timestamps, and the forward hashes match. If true, it anchors curve generation to the mid-to-late 1990s, which lines up with the FIPS 186 drafting window. That is a coherence argument, not a proof. The methodological point is the one worth keeping. Provenance research of this kind is fully reproducible by anyone with a terminal and an afternoon. You do not have to trust Anthropic. You do not have to trust Claude. You take the candidate string, run it through SHA-1, and compare the digest to the published coefficient. It either matches or it does not. This is the rare class of AI-assisted claim that collapses cleanly into a deterministic check — and that is the only reason it deserves attention at all. To test it, you do not need the model. You need the published seed, the published coefficient, and a loop over candidate strings: years, months, dates, product names, document identifiers, and the phrase patterns common in 1990s standards work. Hash each candidate, derive a and b through the specified procedure, compare. The search space is small enough that a determined researcher with a laptop can run it over a weekend. That is what makes the claim falsifiable in the good sense — and also what makes it strange that no independent script has surfaced yet. I ran a similar discipline in 2020, when I spent three months manually reconstructing circuit constraints for an early rollup's fraud-proof fallback. The math did not care that the team had a compelling roadmap. The fraud-proof window was wrong, and the window was wrong because nobody had re-derived it from first principles. I have kept that habit since: reproduce the primitive before you discuss the token. Now the parts that do not hold up. First, the data discrepancy. The report states the work covers five prime-curve seeds and four binary-curve seeds. NIST's binary curve set is conventionally five curves — B-163, B-233, B-283, B-409, B-571. A count of four is either a reporting artifact, a curve whose seed was never published, or an error. Until the original reporting is read line by line, treat the binary-curve portion as unconfirmed. This is not pedantry. In audit work, a count that does not reconcile is a finding, not a rounding error. Second, the security implications are close to zero for the chains people actually care about. Bitcoin and Ethereum use secp256k1, whose parameters are a=0, b=7 — a "nothing up my sleeve" construction that does not depend on any NIST seed. Nothing here touches that. NIST P-256 shows up in TLS, passkeys, some enterprise chains, and HSMs. The finding, if verified, marginally strengthens the transparency case for those parameters. It does not weaken them. Third, and most important: prime-curve seed provenance and the Dual_EC_DRBG scandal are not the same class of object. A random number generator can hide a backdoor in its output mapping — that is what Dual_EC_DRBG did, and why it was withdrawn. A prime curve's coefficients are fully determined by a public hash. There is no known mechanism to embed a trapdoor in the seed-selection step that survives the hash. Conflating the two is the single most common error in the coverage I have read this week. The real risk here is not cryptographic. It is epistemic. An AI model produced a research claim. That claim arrived in public discourse pre-laundered as established fact, attached to an institution with a strong incentive to demonstrate model capability. Anthropic's core business is not cryptanalysis. Selective disclosure of a favorable result is rational behavior for a lab competing on benchmark perception, and no one has yet published the negative results — the candidate strings that did not match, the search space that was exhausted, the confidence intervals on the enumeration. Audits are snapshots, not guarantees. A model that finds a pattern once has demonstrated a search heuristic, not a verification method. The verification is the SHA-1 comparison, and that has not been shown to me by a third party. There is also a twenty-year argument this touches and does not settle. If the seeds trace to neutral dates, that weakens — but does not eliminate — the theory that NIST curves were deliberately chosen to be weak. Weakening a conspiracy theory is not the same as closing it, and the more useful conclusion is the boring one: the industry still has no rigorous, standardized process for auditing how curve parameters are generated. Complexity is the enemy of security, and so is unverified authority wearing a lab coat. What to watch is narrow. Independent reproduction: someone posts a script, the digest matches, the claim becomes fact. Peer review: the claim enters the literature and gets stress-tested. NIST response: confirmation, silence, or correction. Absent those three, this remains a model output, not a finding. The question I would put to the AI-security crowd is this: if the value of an AI cryptanalysis claim is entirely determined by whether a human can independently re-run the check, what exactly is the AI contributing — the search, or the credibility?