Claude traces the NSA’s cryptographic values to a C random-number generator

The trail in the values

The NSA supplied the initial values but never explained how it had produced them. That silence left room for suspicions that the curve parameters had been deliberately weakened, and the puzzle drew the attention of cryptography enthusiasts.

Former NSA employee Jerry Solinas proposed that the values came from the hash of a humorous phrase. That explanation was wrong.

A small generator, a narrow window

Claude traced the values to lrand48, a simple random-number generator in C. It had been run with a Unix timestamp from May 1997 to April 1998.

The clue was in the output: lrand48 produces only 31-bit numbers, and some of the unexplained values consistently had zeroes in their highest bits.

Anthropic estimates that this explanation makes intentional weaknesses less likely. It will give the $36 864 prize for solving the puzzle to the Internet Security Research Group.

I think the speed is striking, but the result is still an explanation of how the values could have been generated, not a record of the original process. The announcement does not say whether independent researchers have verified the reconstruction. That distinction matters: a plausible origin can ease suspicion without settling what happened inside the NSA.