Anthropic’s Claude AI has solved a 25-year-old cryptographic mystery, revealing the mundane origins of a widely used security standard and quelling decades of speculation about a potential National Security Agency (NSA) backdoor.
In a report published on October 16, 2026, the AI research firm detailed how it reverse-engineered the creation of mathematical constants used in digital signatures. This finding bolsters confidence in emerging standards for Ethereum passkey security.
Mystery behind ethereum passkey explained
The mystery centered on a set of “seeds”—public numbers used to generate elliptic curves for cryptography—that the NSA supplied to the National Institute of Standards and Technology (NIST) in the late 1990s. Because the NSA never explained how these seeds were chosen, many in the cryptography community feared they could contain a hidden weakness.
This discovery provides a verifiable explanation, making that scenario far less plausible.
For years, the unexplained origin of these seeds fueled a low-level paranoia among security experts. The constants underpin five NIST-standardized curves, including P-256, which is used for securing vast amounts of internet traffic. Cryptographer Filippo Valsorda even established a bounty, which eventually grew to $36,864, for anyone who could reproduce the numbers.
In less than 30 minutes, Anthropic’s Claude AI achieved what human researchers had failed to do for a quarter-century. The AI identified a subtle but telling pattern in the seed data: several numbers had highest bits that were consistently zero. This statistical anomaly had roughly a 1-in-5,810 chance of occurring randomly, pointing Claude toward lrand48, a common pseudorandom number generator from the Unix era.
By working backward from the known seeds, the AI was able to reconstruct the generator’s internal state. It reproduced the public constants exactly, discovering the process was initialized using standard Unix timestamps from 1997 and 1998.
For the P-256 curve, a timestamp from August 16, 1997, was fed into the generator, and the 1,842nd number it produced was the official seed. This repeatable process suggests the seeds were the product of ordinary 1990s programming, not a sophisticated cryptographic attack.
What This Means for Ethereum Passkey Security
While the discovery has broad implications for internet security, it’s particularly relevant for the future of Ethereum wallets. The Ethereum network’s primary signature algorithm, secp256k1, differs from the NIST curves investigated by Anthropic. Therefore, core transaction security remains unaffected by these findings.
However, a newer standard is bringing P-256 into the Ethereum ecosystem and is set to define the next generation of user-friendly wallets. The connection comes through Ethereum Improvement Proposal 7951 (EIP-7951), which specifies the use of the P-256 curve for verifying signatures from secure hardware devices.
This includes chips in modern smartphones and laptops, such as Apple’s Secure Enclave and Android Keystore, as well as FIDO2 and WebAuthn authenticators. Improving network defense remains a constant goal for developers building these systems.
These systems form the foundation of passkeys, which promise to replace cumbersome seed phrases with familiar biometric or device-based logins. By validating the integrity of P-256’s design, Anthropic’s research provides crucial assurance for developers building these next-generation wallets.
It confirms the foundational cryptography is sound, removing a significant source of doubt that could have hampered passkey adoption in the crypto space. Simplifying key management without compromising security is a critical hurdle, and this finding helps clear the path.
Dispelling the NSA Backdoor Theory
The revelation effectively closes a long and contentious chapter in the history of cryptography. The theory that an NSA mathematician, Jerry Solinas, had generated the seeds by hashing humorous English phrases like “Jerry deserves a raise” had circulated for years. However, it was never reproducible and only added to the folklore and suspicion surrounding the curves.
The truth, as uncovered by Claude AI, is far more ordinary but also more reassuring. Anthropic was quick to state that its findings do not reveal any new vulnerability in the curves themselves. No user action is required, and existing systems using P-256 remain secure. The breakthrough is not about finding a flaw, but about providing transparency where there was once only mystery.
The firm’s researchers claimed the $36,864 bounty and donated it to the Internet Security Research Group (ISRG), the nonprofit behind the Let’s Encrypt initiative. This move further cemented the discovery as a win for the entire security community. This clarity is crucial as the crypto ecosystem continues to evolve, with ongoing developments such as new staking mechanisms under Ethereum EIP-8061.
Unanswered Questions and the Road Ahead
Despite the breakthrough, some minor mysteries still remain. Anthropic’s report noted that the generation process it uncovered produced other mathematically valid candidate curves that were apparently ignored. For example, the 876th candidate generated for P-256 was also viable, and it’s unclear why the 1,842nd was chosen instead.
Furthermore, the origin of the curves’ “base points,” another set of essential fixed numbers, remains unknown. These lingering questions highlight the meticulous nature of cryptographic research, where every parameter must ideally be accounted for. However, they don’t undermine the main finding that a deliberate, hidden backdoor is highly improbable.
The focus now shifts to applying these insights and leveraging the growing power of AI as a tool for mathematical and security audits.
For the Ethereum community, it provides a timely confidence boost in a technology that is poised to make interacting with decentralized applications as simple as unlocking a phone, reflecting ongoing progress and Ethereum’s performance metrics.
Ultimately, the resolution of the P-256 seed mystery is a powerful demonstration of AI’s capability to solve complex, real-world problems. With a stronger foundation of trust, the path toward a more secure and accessible Web3 just became a little clearer.