Nicolas Bacca, co-founder of Ledger, commented in an X post after Claude revealed the origins of the ECDSA curve, saying “Checkmate Satoshi” in what seems to be a playful statement.
In under half an hour, Claude discovered the origins of the NIST P-192, P-224, P-256, P-384, and P-521 seeds, with this reported on October 16, 2026. None of them were the results of any hash algorithm at all, but rather the output of the C library’s lrand48 random-number generator, seeded with a Unix timestamp.
This remains laudable, as for 26 years, cryptographers had suspected the NSA’s mysterious encryption seeds might conceal a backdoor.
Know when your
coins moveAlerts, real-time prices, and market news — all in one app
Point your phone camera to install
4.8 based on 40K reviews in the App Store and Google Play
Blockstream CEO Adam Back subsequently weighed in on the discussion, saying, “That’s the NSA’s fault for not revealing the reproducible steps to generate their NIST published curves.” Bacca responded, saying, “Right, but it still made a good joke.”
@BTChip That’s NSA fault for not revealing through reproducible steps to generate their NIST published curves.
— Adam Back (@adam3us) October 17, 2026
In 2000, NIST incorporated the P-256 curve into standards, with parameters derived from hashing a 160-bit seed. The seed was provided by the NSA, and its origin was never explained, so speculation about “backdoors” never stopped.
Satoshi’s Bitcoin decision comes into focus
According to Coinbase wallet lead Pete Kim, the choice of secp256k1 over r1 (P-256) in Bitcoin (and Ethereum) was heavily influenced by the fear of an NSA backdoor. “turns out there is no backdoor after all,” Kim wrote, commending Anthropic.
In reaction to the milestone, a crypto user pointed out that the reason Bitcoin’s pseudonymous creator, Satoshi Nakamoto, did not choose the NSA’s P-256 curve when founding Bitcoin but rather secp256k1, came back into discussion following the Claude reveal, noting that what was cracked in 30 minutes is not just a number but rather 26 years of global internet paranoia.
Some believe Satoshi probably chose secp256k1 instead of the NSA’s P-256 because of this mystery, as it might be easier to trust the number 7 (the coefficient in secp256k1) than the coefficient in P-256.
Claude traced the NIST P-curve seeds to a 1990s random-number generator seeded with timestamps, but Bitcoin never used those curves. This discovery makes backdoors less plausible but does not make ECDSA less secure.
Leave a Reply
You must be logged in to post a comment.