Anthropic Reveals NSA-Linked Origin of Ethereum P-256 Curve Seed

iconCryptoSlate
Share
AI summary iconSummary
Ethereum news broke on Oct. 16 as Anthropic revealed that its AI model Claude uncovered the public seed behind Ethereum’s P-256 cryptographic curve. The seed, generated using a timestamp from Aug. 16, 1997, and the lrand48 algorithm, addresses long-standing questions about the curve’s origin and potential NSA influence. No backdoors were found, and users are advised to take no action. Ethereum ecosystem news highlights the curve’s role in EIP-7951 for signature verification and hardware-based signing.

Anthropic said on Oct. 16 that Claude had helped reconstruct the public seed behind P-256, a NIST-standardized cryptographic curve supported for Ethereum passkey signing. The finding gives wallet builders new evidence about longstanding concerns over the curve's origins. A public seed is a design input used to derive a coefficient in the curve's equation. The public seed is separate from private signing credentials that authorize wallet activity.

Anthropic says unexplained seeds supplied by the U.S. National Security Agency had fueled suspicion about deliberately weakened parameters. Anthropic's published recipe initializes the old C-library generator lrand48 with the timestamp for Aug. 16, 1997, at 01:52:34 UTC. The generator produces a sequence of candidate seeds. Advancing to candidate 1,842 returns the published P-256 value, providing a repeatable recipe for that public constant.

Anthropic says the finding makes deliberate backdoors less plausible. Anthropic describes no new attack or curve weakness and says users need take no action.

Ethereum's EIP-7951 specifies verification of signatures using P-256, also called secp256r1. EIP-7951 names Apple Secure Enclave, Android Keystore and FIDO2/WebAuthn devices as relevant hardware. This connects wallet authorization with signing capabilities built into devices and authenticators. EIP-7951's motivation lists device-native signing, multifactor authentication and simpler key management as uses for account abstraction.

Ethereum's account documentation distinguishes private keys that sign transactions from public information used to verify transactions. Contract accounts are controlled by code. EIP-7951's P256VERIFY operation takes a message hash, a signature and a public key, then checks the signature's validity. P-256 differs from secp256k1, the curve already used in Ethereum. The finding is relevant to P-256-compatible signing, rather than every Ethereum wallet.

Anthropic reports that candidate 876 also yielded a prime-order curve of the required size, leaving selection criteria unclear. The number of generation runs remains unknown. The origin of P-256's base point, a separate fixed mathematical point, also remains unknown.

Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information. Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.