NIST Elliptic Curves: Seed Mystery Solved, $36,864 Bounty to Let's Encrypt
An Anthropic team has determined how the NIST curve seeds used in TLS were generated. Filippo Valsorda's bounty of $36,864 goes to ISRG/Let's Encrypt.
UptimeMag editorial team · 29 October 2026 · 2 min read
A 26-year-old question about the cryptography underlying much of the web was answered on 16 October 2026. An Anthropic team has reconstructed the method by which, in the late 1990s, the "seeds" for the elliptic curves standardised by NIST were generated—the same curves on which ECDSA and therefore countless TLS connections are based, including certificates issued by Let's Encrypt. The bounty offered for finding the answer, $36,864, now goes to ISRG, the non-profit organisation that operates Let's Encrypt.
Why the doubt existed
The NIST curves P-192, P-224, P-256, P-384 and P-521 were published in 2000 with seeds provided by the NSA, with no explanation of the generation method. Suspicions that they might hide an intentional weakness were not unfounded: the NSA had indeed inserted a backdoor into another NIST standard, the Dual_EC_DRBG random generator, as confirmed by documents released by Edward Snowden in 2013, leading to the standard's withdrawal in 2014.
The bounty and the solution
On 5 October 2023, cryptographer Filippo Valsorda announced a bounty for the seeds, initially offering $12,288, tripled to $36,864 if the recipient chose to donate it to a non-profit organisation. A group of engineers had contributed their own funds to finance the prize.
The puzzle was solved by an internal Anthropic research model, Claude, which reconstructed the seeds for curves P-192, P-224, P-256, P-384 and P-521 by tracing them back to the lrand48 generator, initialised with Unix timestamps between May 1997 and April 1998, in less than half an hour. Valsorda verified the result by reimplementing the algorithm in Go.
The Anthropic team chose to donate the prize to ISRG, the non-profit that operates Let's Encrypt. The finding does not constitute a break of ECDSA, nor does it reveal any new attack. However, some points remain unexplained: the origin of the seed for the B-163 binary curve and the precise method of selecting certain subsequent base points remain undetermined.
For those managing TLS certificates and infrastructures relying on ECDSA, the news requires no action: no curves need replacing, no updates are required. However, it adds another piece to the public documentation of the cryptography underpinning the majority of today's HTTPS traffic.
Written with the help of artificial intelligence and checked by the editors (EU AI Act, art. 50). Source: Let's Encrypt.