Anthropic says Claude helped reconstruct the public seed behind P-256, a curve supported for Ethereum passkey signing. The company says the finding makes deliberate backdoors less plausible and that users need take no action. Open questions remain, including how candidates were selected and where the curve's base point came from.
Anthropic said on Oct. 16 that Claude had helped reconstruct the public seed behind P-256, a NIST-standardized cryptographic curve supported for Ethereum passkey signing. The finding gives wallet builders new evidence about a longstanding concern over the curve's origins.
How the seed was rebuilt
The seed is a public design input used to derive a coefficient in the curve's equation, and it is separate from the private signing credentials that authorize wallet activity. Anthropic says unexplained seeds supplied by the U.S. National Security Agency had fueled suspicion about deliberately weakened parameters.
The company's recipe initializes the old C-library generator lrand48 with the timestamp for Aug. 16, 1997, at 01:52:34 UTC. The generator produces a sequence of candidate seeds, and advancing to candidate 1,842 returns the published P-256 value. That gives a repeatable recipe for the public constant.
Anthropic says this makes deliberate backdoors less plausible. However, it describes no new attack or curve weakness and says users need take no action.
Why Ethereum passkeys are affected
The Ethereum connection runs through EIP-7951, which specifies verification of signatures using P-256, also called secp256r1. It names Apple Secure Enclave, Android Keystore and FIDO2/WebAuthn devices as relevant hardware. Its motivation lists device-native signing, multifactor authentication and simpler key management as uses for account abstraction.
P-256 also differs from secp256k1, the curve already used in Ethereum. The relevance is to P-256-compatible signing, rather than to every Ethereum wallet.
What remains unknown
Anthropic reports that candidate 876 also yielded a prime-order curve of the required size, which leaves the selection criteria unclear. The number of generation runs and the origin of P-256's base point, a separate fixed mathematical point, remain unknown.
Source: CryptoSlate
Trading involves risk.
Risk Disclaimer
