The bounty on the origin of the NIST elliptic curve seeds (P-192, P-224, P-256, P-384, P-521, published in FIPS 186-2 in 2000), announced three years ago, has been claimed in full. On October 15, 2026, a team from Anthropic showed that the seeds were generated with the POSIX drand48 PRNG seeded with UNIX timestamps from 1997–98 — not, as long-standing lore held, by hashing English sentences that Jerry Solinas later forgot. The method: srand48() with a then-current timestamp, then testing each 20-byte output as a seed under ANSI X9.62 until a valid curve was produced.

Per the post, this rules out the Bernstein–Lange technique that could in principle have exploited ~70 bits of seed freedom to target a hypothetical class of weak curves or embed a NOBUS backdoor: even under generous assumptions, barely 30 bits of freedom remain. Two undocumented rejection criteria beyond ANSI X9.62 were identified, one of which is still unexplained. The solving team donated the prize to ISRG (the non-profit that operates Let’s Encrypt), tripling it to $36,864. The blog’s author verified the claim with a Go reimplementation and argues that, alongside deterministic ECDSA, formally verified implementations, and the 2015 complete addition formulas, this completes the “rehabilitation arc” of NIST elliptic curve cryptography — he says he would now personally recommend the NIST curves over Curve25519/Ed25519/X25519. https://words.filippo.io/seeds-solved/