01:52:34 UTC

At 01:52:34 UTC on August 16, 1997, a program began producing numbers.

We can now read that time back from one of them.

The number became the published seed for P-256, one of the elliptic curves included in NIST's 2000 Digital Signature Standard. The standard supplied the curve parameters and a 20-byte seed beginning C49D3608. It did not explain where those particular bytes came from.

That omission created a durable kind of suspicion. A seed helps derive part of the curve, so an unexplained seed leaves open the question of how much choice its maker had. The values had been supplied by the National Security Agency. People could verify the published mathematics and still wonder whether the starting numbers had been selected to hide some useful weakness.

The uncertainty outlived the process that created it.

In 2015, Neal Koblitz and Alfred Menezes devoted a paper to the controversy. It preserved an account from Jerry Solinas, who had worked on the curves, that the seeds may have come from hashing a humorous phrase. He and a colleague could not remember the exact message or locate the old records. Solinas died in 2023, leaving the recollection as one of the few human traces of an ordinary technical decision that had become cryptographic folklore.

The phrase turned out not to be there.

Anthropic reports that an internal research model approached the numbers as the output of a 1990s program instead. It tested old pseudorandom-number generators, found a fingerprint left by the rand48 family, reconstructed each generator's internal state, and ran it backward to the kind of value used to initialize it. For five prime-field curves, those values were Unix timestamps from 1997 and 1998.

For P-256, the recovered timestamp is 871696354: August 16, 1997, at 01:52:34 UTC. Starting the generator there and following the documented curve recipe reproduces the published seed as the 1,842nd 20-byte candidate. The researchers published their method and code in their account of the discovery. Filippo Valsorda, who organized a public bounty for the answer, independently reimplemented the sequence and declared the bounty solved.

The result is reassuring without being complete. It is not a new attack on P-256, and the recovered process makes a deliberately planted weakness less plausible. The clock and generator leave far less room for secret selection than an arbitrary unexplained number.

They do not remove every choice.

The same run produced an earlier candidate, number 876, that also appears to satisfy the published construction. Nobody has recovered why it was skipped while 1,842 became P-256. Several base points remain unexplained, and the seed for the binary curve B-163 has not been matched. The recovered computation tells us how bytes moved through a program. It cannot tell us what the people at the keyboard noticed, rejected, or discussed.

That distinction is useful well beyond this standard. Reproducible output is not the same as a preserved decision record. A future reader may be able to rerun a generator, verify a proof, or rebuild an artifact and still be unable to answer why one valid result was chosen over another.

The missing record does not have to be elaborate. A generation script, the initial value, the sequence of candidates, the selection rule, and a short note about exceptions would have turned years of speculation into a routine audit. Archiving the toolchain would help too. Randomness can be public while the reason for stopping at one result remains private by accident.

There is some tenderness in the correction. A person remembered a joke because that was the kind of thing people did in the room. The machine found a clock because that was what the program left in the numbers. Memory kept the atmosphere; computation recovered the mechanism.

We now know what was running at 01:52:34 UTC. We still do not know who looked at candidate 876, why it was passed over, or where that decision was written down, if it ever was.