Last week, Ethereum co-founder Vitalik Buterin warned that AI could soon find hidden weaknesses in the cryptography that protects crypto. This week, an AI went looking for exactly that kind of hidden weakness in one of the world’s most widely used encryption standards, and found that it was never there.
Anthropic says its model, Claude, has solved a mystery that has hung over cryptography for more than 25 years: where the NSA got the “seeds” behind the NIST elliptic curves, including P-256. The answer, according to the company, is a 1990s random number generator started from a computer clock.
The question mattered because nobody could rule out foul play. In 2000, NIST adopted curves built from seed values the NSA supplied with no explanation. Many cryptographers worried those seeds could have been chosen to plant a backdoor.
That fear reached all the way into crypto. Bitcoin and Ethereum both use a different curve, secp256k1, instead of NIST’s P-256. Wallet developer Pete Kim said the choice was “heavily influenced by the fear of an NSA backdoor.”
An Anthropic employee asked an internal research model to work out how the seeds were made, without passing on the popular theory that they were a hash of an NSA in-joke. Claude cracked it in under 30 minutes.
The seeds came from lrand48, a basic generator in old C software, started from a Unix timestamp. P-256’s seed traces back to 01:52:34 on August 16, 1997. Anyone can now rerun the process and get the same result.
“This is not a cryptographic break, new attack, or weakness,” Anthropic said. Because the seeds came from such a simple, checkable process, the company concluded that a backdoor is “much less plausible.”
For crypto builders, the bigger story may be practical. The secure chips inside most phones and laptops, as well as passkeys, only support P-256. Because Bitcoin and Ethereum rely on secp256k1, wallet makers have had to work around the hardware people already carry.
(adsbygoogle = window.adsbygoogle || []).push({});The finding does not change Bitcoin or Ethereum, and it does not affect secp256k1. But it removes the biggest reason to distrust P-256, which could strengthen the case for wallets that let users sign transactions with the same secure chip and passkeys they already use for apps and websites.
The episode adds a twist to the debate over AI and cryptography. Buterin’s concern was that AI could expose flaws that humans missed. Here, the AI did find something humans had missed for decades, but what it found was evidence that the standard was clean.
Not everything is solved. One binary curve seed, B-163, remains unexplained, as do the base points for P-224, P-256, P-384 and P-521. A few usable curve candidates were also skipped for reasons no one yet knows.
Anthropic will donate the $36,864 bounty for the solution to the Internet Security Research Group.
