Claude traces the origin of NIST's elliptic curve seeds and cuts the gate count of a quantum circuit for breaking elliptic curve cryptography to one-seventeenth

On the same day, Anthropic published two cryptography-related studies on its research page (primary source). One shrinks the quantum circuit needed to break elliptic curve cryptography, cutting its gate count to one-seventeenth. The other finds that the seeds for NIST's elliptic curves were generated from lrand48. In both, Claude carried out the research.

The two studies point in different directions. The first lowers estimates of the quantum resources needed to break elliptic curve cryptography. The second adds facts, rather than speculation, to a 25-year-old debate over whether NIST's curves contain a backdoor. One addresses a future threat and the other a past suspicion. On the same day, the assumptions used to estimate cryptographic security shifted from both sides.

Quantum circuits: lower resource estimates for breaking encryption

Elliptic curve cryptography underpins most of the internet's public-key cryptography today, including key exchange in TLS, digital signatures and signatures for crypto assets. It has long been known that a large enough quantum computer could use Shor's algorithm to solve the discrete logarithm problem on elliptic curves. What has been less clear is how many quantum resources that would take.

Estimates of when quantum attacks become practical depend on circuit size. Fewer gates mean less error correction, fewer physical qubits and shorter run times, so a machine of a given capability could break the encryption sooner. Anthropic's study cut the gate count of this circuit to one-seventeenth. Quantum computers have not become any faster, but the bar for how much hardware is needed to break the encryption has moved closer.

For defenders, the result is a reason to speed up migration. Plans to move to post-quantum cryptography are built around estimates of when quantum attacks will arrive. The circuit cost underlying those estimates has moved by more than an order of magnitude, so the assumptions behind those plans need to be revisited. In the context of AI for Science, the result joins work in mathematics and physics as an example of AI designing a circuit that far outperforms existing optimizations.

NIST's curve seeds: an origin for 25 years of suspicion

NIST's elliptic curves, including P-256, became standards in FIPS 186-2 in 2000. The curve coefficients were said to be derived by passing a seed through SHA-1. The security argument was that because anyone could recompute the coefficients from the seed, the designers could not have picked whatever curve they wanted. But how the seeds themselves were chosen was never explained.

After it emerged in 2013 that Dual_EC_DRBG contained an NSA backdoor, this gap became a target of suspicion. If the designers were free to choose the seeds, they might have tried large numbers of them and picked a curve with a weakness only they knew about. NIST's curves remained in use, but the question of where the seeds came from could not be checked.

Anthropic's study found that the seeds were generated from lrand48. lrand48 is a pseudorandom number function in the POSIX standard C library, and its internal state is a 48-bit linear congruential generator. If the seeds are output from this function, their origin is tied to a specific generation method, and the range of values they could have taken becomes something that can be checked.

This does not settle whether a backdoor exists. But the debate has so far been about an absence: the lack of any explanation. Now that the generation method has been identified, the discussion moves to a question that can be counted and checked: how much freedom that method gave the designers to choose a curve. For the first time, verifiable facts have been added to 25 years of speculation.

What two studies on the same day show

Taken together, the two studies show AI beginning to update estimates of cryptographic security from both sides. The quantum circuit work lowered the cost of an attack that has not happened yet. The seed work dug up the history of a standard that is already in use. The first bears on the timeline for moving to post-quantum cryptography. The second bears on whether existing curves can still be trusted.

Both studies tackle problems experts have worked on for years, and in both Claude produced concrete numbers or facts. Optimizing a circuit to cut its gate count by more than an order of magnitude and identifying how an old standard was generated are both long-horizon tasks that require long rounds of trial and verification. Since September, Anthropic has released a run of research results produced with Claude in mathematics, physics and biology. This time it has moved into cryptography, a field tied directly to national security.

Whether each result helps defense or attack varies. Identifying the origin of the seeds can only make the standards more transparent. Shrinking the quantum circuit, on the other hand, is itself knowledge that lowers the resources an attack needs. For organizations migrating to post-quantum cryptography, it is reasonable to read the one-seventeenth figure as grounds for moving their migration deadlines forward.