Hook
The headline said an AI had cracked a twenty-year cryptographic mystery. I went looking for the search space instead.
It is 2^48. That is 281,474,976,710,656 โ a number small enough to fit on one line, and small enough that a single modern CPU core walks through it in an afternoon. The verification step is one SHA-1 call against a value that has been printed in a public standard since the late 1990s.
If that reads as a disappointment, it shouldn't. A claim that survives arithmetic is worth more than a claim that survives a press cycle. So let me be precise about what Claude appears to have done with the NIST P-curve generation seeds, and what it did not do โ because the second list is longer, and the first list is still genuinely interesting.
I have not verified Anthropic's original write-up or repository. My analysis rests on the secondhand reporting and on the published specifications of the primitives involved. Everything below is recomputable from those specifications. That is the entire point.
Context
The NIST P-curves โ P-192, P-224, P-256, P-384, P-521 โ were generated under a procedure documented in ANSI X9.62 Annex A.3.2. The flow is mechanical: take a seed, hash it with SHA-1 to produce a value c, derive the curve coefficient b from c, and compare against the published b. The seed's only function is to serve as a tamper-evident commitment. It proves nobody shopped for a b with convenient weaknesses. The b itself is public. It has been public for decades.
This matters because of a long-running argument. The "nothing up my sleeve" critique, pushed hardest by Daniel Bernstein, holds that a curve whose parameters cannot be derived from a transparent, low-entropy seed is a curve you must trust rather than verify. It became the core narrative advantage of Curve25519 over P-256 in implementation-security circles. Layer on top of it the 2013 Snowden disclosures and the general discomfort of a signal-intelligence agency supplying civilian cryptographic parameters without disclosing methodology, and you get a two-decade trust deficit that no amount of FIPS paperwork ever closed.
The seed was never published. For twenty years, that omission read as either carelessness or something worse. This is the gap the Claude result claims to fill. So the question is not whether the story is exciting. The question is whether the method is sound.
Core
Start with the arithmetic, because the arithmetic is the argument.
lrand48 is a POSIX linear congruential generator. State is 48 bits: a = 0x5DEECE66D, c = 0xB, m = 2^48. Full period is 2.8ร10^14. Constrain the seed to plausible Unix timestamps โ say 1985 through 2000, roughly 4.7ร10^8 seconds, or 2^29 โ and the candidate set drops to a few hundred million. Each candidate costs one SHA-1 evaluation. A modern core does 10^7 to 10^8 of those per second. The entire timestamp-constrained space is a single-machine job measured in minutes to hours, not a compute campaign.
That single calculation dismantles the "AI cracked it with raw compute" reading. It also opens the genuinely interesting question, which is what the model actually contributed.
The answer is prior narrowing. The hard part was never enumeration; the hard part was the hypothesis "a 1990s engineer generating 160 bits of key material would have reached for lrand48 and fed it a clock value." That hypothesis compresses an effectively infinite library-call space into something searchable. Claude appears to have produced it. That is real work, and it is knowledge retrieval plus compositional inference โ an engineering-grade capability applied well, not a reasoning breakthrough. I have run this exact pattern. My 2020 Curve/Uniswap arbitrage bot executed 150 trades daily at 99.8% accuracy, and the reason it worked was not clever logic. It was that the verification loop was deterministic and cheap. Determinism is what makes a claim auditable. Everything else is narrative.
The strongest technical reason to take this result seriously is that five curves fall out of one mechanism. P-192 through P-521 are all explained by the same lrand48-plus-timestamp procedure. A single curve match already excludes coincidence at the 2^-160 level. Five curves sharing a single generation story is a structural explanation rather than a fit, and it largely forecloses the possibility that someone reverse-engineered a plausible-sounding story after the fact. That is why I move my prior from "marketing" to "probably real, probably oversold."
Two things remain unresolved. The reported 1,842 iterations is ambiguous. If it counts timestamp candidates, then the anchor question is unanswered: who supplied the starting point, a human hint or the model? If it counts the hash counter inside the ANSI loop, it contradicts the known derivation rule, which succeeds roughly half the time per attempt with an expectation near two โ implying an undisclosed process variant. Either reading leaves the human/AI division of labor undefined, and that division is the only basis for any capability generalization.
And then the cryptography, which the coverage has largely inverted. Seed entropy is irrelevant to curve security. The seed is a commitment device, nothing more. A low-entropy seed has precisely zero impact on the hardness of the discrete log problem. What it does have is optics: it exposes that long-lived infrastructure parameters were generated by feeding a timestamp into a weak PRNG, and it offers a plausible answer to why the seed was withheld โ publication would have shown the process for what it was. That is embarrassing. It is not dangerous.
Contrarian
Three conflations are doing quiet work in the coverage.
The first is Dual_EC_DRBG. The 2013 disclosures were about a backdoored random number generator. Curve parameters are a separate thread entirely. Fusing the two lets a reader conclude that this result somehow rehabilitates NIST's institutional trust. It does not. Two independent problems do not cancel.
The second is secp256k1. Web3 audiences will map this story onto Bitcoin. Different standards body, different generation history, no shared derivation path. One clarifying sentence was owed and was not paid.
The third is the one that actually matters, and it is a correlation-versus-causation problem. If the seed space is enumerable, then it was always enumerable โ including in 1998. Someone could have generated a large family of candidate curves and selected one with hidden properties. Recovering the generation procedure does not exclude that. The executable test is to enumerate every curve the lrand48 family can produce and then interrogate P-256's b for a small class number, a low embedding degree, or exposed GHS attack surface. That is the only test that would materially move P-256's trust balance, and it is the real research agenda this result opens.
Which brings me to the counterfactual nobody has run: could a competent cryptography engineer have done this in a weekend? I suspect yes. If yes, then the finding is attention scarcity, not capability scarcity, and the twenty-year-mystery framing deflates on contact. This is the "too good to be true" tell โ a two-decade mystery that dissolves in one afternoon of enumeration was never a mystery. It was an unasked question.
Takeaway
Watch for two things. First, the seed value and the script. If Anthropic publishes both, the claim converts from assertion to verified fact in seconds and the credibility gain is permanent. If it publishes neither, the "too good to be true" reading flips hard โ in cryptography an unreproducible claim is the most expensive kind of failure, and the people who matter will say so quietly and permanently.
Second, watch the standards bodies. Parameter publication without derivation seeds now operates under a new assumption: the seed can be recovered later anyway, so withholding it buys nothing and costs trust. Watch whether NIST, SECG, or IETF amend publication norms in the next revision cycle. That, not the model, is the durable output of this week.