Claude Reconstructs P-256 Seed Linked to Ethereum Passkeys

Anthropic reported on Oct. 16 that Claude had reconstructed the public seed behind P-256, a NIST-standardized cryptographic curve used in some Ethereum passkey systems. The result provides a reproducible method for generating the seed, which had drawn questions because of its unexplained connection to the U.S. National Security Agency.

The reconstruction uses Aug. 16, 1997, at 01:52:34 UTC, as the starting timestamp for lrand48, an older C-library random-number generator. Running the generator produces a sequence of candidate values. The published P-256 seed appears at candidate 1,842.

The seed is a public input used to derive one of the coefficients in the curve’s equation. It is separate from private keys and other credentials used to authorize wallet activity. Anthropic described the repeatable process as making deliberate weakening of the curve less plausible. The company reported no new attack on P-256 and said users do not need to change their security settings.

P-256 is relevant to Ethereum through EIP-7951, a proposal that specifies the P256VERIFY operation for checking P-256 signatures. The curve is also known as secp256r1. The proposal names Apple’s Secure Enclave, Android Keystore and FIDO2/WebAuthn authenticators as examples of systems that support related device-based signing.

Passkeys and other hardware-backed authentication tools can use those systems. EIP-7951 lists device-native signing, multifactor authentication and simpler key management as possible uses for Ethereum accounts. P256VERIFY takes a message hash, a signature and a public key, then checks whether the signature is valid.

Questions about the curve’s generation remain unresolved. Anthropic reported that candidate 876 also produced a prime-order curve of the required size, but the criteria for rejecting or skipping candidates have not been explained. The number of generation runs is unknown. The origin of P-256’s base point, a separate fixed mathematical point used by the curve, is also unknown.

P-256 is different from secp256k1, the curve commonly used for standard Ethereum transaction signatures. The reconstruction therefore concerns wallets and account systems using P-256 passkey or hardware-backed signing, rather than all Ethereum wallets.