- Claude traced the NSA’s NIST curve seeds to a 1990s generator seeded by a clock.
- The discovery makes a hidden backdoor in curves such as P-256 far less plausible
- Claude solved the puzzle in under 30 minutes after years of failed human search.
Last week, Ethereum co-founder Vitalik Buterin warned that AI could soon find hidden weaknesses in the cryptography that protects crypto. This week, an AI went looking for exactly that kind of hidden weakness in one of the world’s most widely used encryption standards, and found that it was never there.
Anthropic says its model, Claude, has solved a mystery that has hung over cryptography for more than 25 years: where the NSA got the “seeds” behind the NIST elliptic curves, including P-256. The answer, according to the company, is a 1990s random number generator started from a computer clock.
Suspicion That Shaped Bitcoin
The question mattered because nobody could rule out foul play. In 2000, NIST adopted curves built from seed values the NSA supplied with no explanation. Many cryptographers worried those seeds could have been chosen to plant a backdoor.
That fear reached all the way into crypto. Bitcoin and Ethereum both use a different curve, secp256k1, instead of NIST’s P-256. Wallet developer Pete Kim said the choice was “heavily influenced by the fear of an NSA backdoor.”
What Claude Actually Found
An Anthropic employee asked an internal research model to work out how the seeds were made, without passing on the popular theory that they were a hash of an NSA in-joke. Claude cracked it in under 30 minutes.
The seeds came from lrand48, a basic generator in old C software, started from a Unix timestamp. P-256’s seed traces back to 01:52:34 on August 16, 1997. Anyone can now rerun the process and get the same result.
“This is not a cryptographic break, new attack, or weakness,” Anthropic said. Because the seeds came from such a simple, checkable process, the company concluded that a backdoor is “much less plausible.”
Related: OpenAI Admits Its AI Spent Another Person’s Testnet Ether, Then Left It Out of the Report
Wallet Problem This Could Ease
For crypto builders, the bigger story may be practical. The secure chips inside most phones and laptops, as well as passkeys, only support P-256. Because Bitcoin and Ethereum rely on secp256k1, wallet makers have had to work around the hardware people already carry.
“This has been very annoying for wallet developers,” Kim wrote. “Turns out there is no backdoor after all.”
The finding does not change Bitcoin or Ethereum, and it does not affect secp256k1. But it removes the biggest reason to distrust P-256, which could strengthen the case for wallets that let users sign transactions with the same secure chip and passkeys they already use for apps and websites.
AI As Auditor, Not Attacker
The episode adds a twist to the debate over AI and cryptography. Buterin’s concern was that AI could expose flaws that humans missed. Here, the AI did find something humans had missed for decades, but what it found was evidence that the standard was clean.
Not everything is solved. One binary curve seed, B-163, remains unexplained, as do the base points for P-224, P-256, P-384 and P-521. A few usable curve candidates were also skipped for reasons no one yet knows.
Anthropic will donate the $36,864 bounty for the solution to the Internet Security Research Group.
Related: IMF Warns AI Investment Crash Could Risk Global Economic Growth
Disclaimer: The information presented in this article is for informational and educational purposes only. The article does not constitute financial advice or advice of any kind. Coin Edition is not responsible for any losses incurred as a result of the utilization of content, products, or services mentioned. Readers are advised to exercise caution before taking any action related to the company.
