THE NSA’S P-256 SEED WAS CANDIDATE 1,842 FROM AN AUG. 16, 1997 CLOCK — WHY AN EARLIER VALID CURVE WAS SKIPPED IS UNKNOWN — BITCOIN’S CURVE NEVER HAD A SEED
On October 16, 2026, Anthropic said its Claude model had worked out where the seeds for five NIST curves came from. The seeds behind P-192, P-224, P-256, P-384 and P-521 were never secret phrases. Anthropic says they were “the output of the C library's <code>lrand48</code> random-number generator, seeded with a Unix timestamp.” For P-256 the clock read August 16, 1997, and the seed used was candidate 1,842 of that run. Anyone can now rerun the code and get the same 160 bits.
Bitcoin does not sign with P-256. It signs with secp256k1, and that is the point. The SEC 2 standard lists secp256r1, the same curve as P-256, with a seed. It lists secp256k1 with none. The curve is y<sup>2</sup> = x<sup>3</sup> + 7 over the prime 2<sup>256</sup> minus 2<sup>32</sup> minus 977. There was never a hidden input to explain, so there was nothing to crack.
Explained is not the same as proven. Anthropic's own write-up says candidate 876 of the same P-256 run also gave a usable curve and was passed over, and that P-224's run “passed over three such curves.” It says, “We do not know what criteria may have been used, or whether this was an unintentional artifact.” Anthropic argues the skips are too few for a weak curve to have been picked, and how the P-256 base point was made is still unknown. That is far more than anyone could show before. It still rests on a judgment about why someone in 1997 kept one curve and dropped another.
A seed you can now check beats a seed you could not. A curve with no seed beats both. The test for money that settles without trust is the same test: can a stranger rerun it and get the same answer, with no story about who picked what? At the time of this writing, bitcoin was $81,390.