Claude’s Reported NIST Curve Seed Discovery Does Not Prove Bitcoin’s Curve Choice Was About Backdoors

Anthropic’s Claude reportedly traced the origins of seeds used for five NIST elliptic curves to outputs from the C library’s lrand48 generator, seeded with Unix timestamps. The reconstruction could help explain a long-running source of suspicion. It has not been shown to prove the curves are free of weaknesses or to explain why Satoshi Nakamoto chose Bitcoin’s curve.

• The reported finding concerns the origins of public curve seeds, not a break of ECDSA.
• The Defiant says published code covers five prime-curve seeds and four binary-curve seeds.
• Bitcoin uses secp256k1. Satoshi’s reason for choosing it remains unconfirmed.

The Defiant reported that Claude traced the seeds for NIST’s P-192, P-224, P-256, P-384 and P-521 curves to lrand48 outputs. The report also refers to published code covering four binary-curve seeds, but does not identify those curves or establish whether all nine seeds were generated the same way.

The report does not lay out the full reconstruction method or show that independent cryptographers have reproduced it. For now, treat it as a reported technical finding, not a settled security audit.

The claim prompted Ledger co-founder Nicolas Bacca to joke:

“Checkmate Satoshi”

Blockstream CEO Adam Back pushed back on the implication, pointing instead to the lack of a transparent process for generating the curves:

“That's the NSA's fault for not revealing the reproducible steps to generate their NIST published curves.”

Bacca replied that it was still a good joke. The exchange gets to the heart of the issue: unexplained parameters invite distrust, especially when an intelligence agency is involved.

What the seed claim means, and what it doesn’t

A curve seed is a public input used in a defined process to derive or specify curve parameters. It is not a private key. The reported lrand48 connection concerns the claimed origin of the seed. On its own, it does not show how the seed was later used or whether the resulting curve is secure.

That distinction matters for P-256. Accounts of the curve’s history describe a 160-bit seed supplied by the NSA, with parameters derived through hashing. Those details could fit with the reported lrand48 result: a generator might produce a seed that is then processed by a hash. But the report does not show that this is what happened, so the connection remains unclear.

NIST incorporated P-256 into its standards in 2000, according to accounts of the curve’s history. Because the seed’s origin was never explained, some worried that the parameters might conceal a backdoor, a hidden weakness that could undermine cryptography built on the curve.

If the reconstruction is correct, it offers a possible explanation for the seeds’ origins and may make the backdoor theory less persuasive. It does not prove that no weakness exists. The reported finding also does not demonstrate an attack on ECDSA, the digital-signature algorithm associated with these curves.

Adam Back’s point has two parts. A standard can give users reproducible steps for generating parameters from a seed without explaining why that seed was chosen. Reproducible generation lets others check the process. Transparent seed selection addresses a separate question: how the input was picked.

Bitcoin’s curve choice does not reveal Satoshi’s motive

Bitcoin uses secp256k1 rather than NIST’s P-256, also known as r1. Ethereum also uses secp256k1 for ECDSA signatures. Coinbase wallet lead Pete Kim said concern about a possible NSA backdoor heavily influenced the choice of secp256k1 over r1. He wrote, “turns out there is no backdoor after all, ” while praising Anthropic’s work.

Kim’s remark is an interpretation of the reported finding, not proof that a backdoor has been ruled out. Concerns about P-256 have also been cited as a reason for Bitcoin’s curve choice, but there is no direct evidence here that this was Satoshi’s motive.

Some observers have pointed to secp256k1’s simple equation, whose coefficient is 7, as easier to trust than parameters with an unexplained origin. That is a plausible argument for transparency, not a documented explanation from Nakamoto. Ethereum’s use of the same curve does not explain why Bitcoin chose it either.

Bitcoin’s signature history extends beyond ECDSA: it has used ECDSA on secp256k1, and Taproot added support for Schnorr signatures on the same curve. The reported seed reconstruction changes neither Bitcoin’s curve nor what is known about why it was selected.

The finding does not conclusively settle an old suspicion. It does underscore that cryptographic trust depends on processes people can inspect and reproduce. A credible explanation for a seed can reduce uncertainty, but it cannot replace independent scrutiny.

Key questions and answers

• What did Claude reportedly find?

  The Defiant reported that seeds for five NIST prime curves were traced to lrand48 outputs seeded with Unix timestamps. The account does not give enough detail to assess the full method.

• Has the reconstruction been independently verified?

  The reported information does not name independent cryptographers who reproduced it. That remains a key point to establish.

• Does the finding prove there was no backdoor?

  No. It may explain the seeds and reduce suspicion, but it does not rule out every possible weakness.

• Does the report show that ECDSA is broken?

  No. The reported seed reconstruction does not demonstrate an attack on ECDSA.

• Why did Satoshi choose secp256k1?

  The reason is unconfirmed. Distrust of P-256’s unexplained parameters is one proposed explanation, not documented evidence of Nakamoto’s thinking.