A headline crossed my desk this week: Claude had "unpicked the NSA mystery" behind the elliptic curve that secures every Passkey wallet on Ethereum. I read the arithmetic before I read the applause. The reconstruction, if it holds, recovers the preimage string used to derive the P-256 seed. It does not recover the reason that seed was chosen. Those are two different objects. One is arithmetic; the other is motive. Arithmetic is enumerable; motive is not. The headline declared the mystery solved. Three paragraphs down, the body text admitted that "the selection criteria and the base point origin remain unexplained." That single sentence is the entire story; everything above it is framing. Code does not lie, but it often omits the truth โ and press releases omit it more predictably than code ever could. My job here is not to celebrate a solved puzzle. It is to measure the distance between what was proven and what was implied.
First, a correction that the coverage blurred into a single word. P-256 is NIST's secp256r1. Ethereum's native signing curve is secp256k1. They are not the same object; they do not share a generator, a field, or a trust history. The default Ethereum account signs with ECDSA over a Koblitz curve โ secp256k1. Passkeys sign with secp256r1, because that is what Apple's Secure Enclave and Google's Titan chip will produce. The bridge between the two is a precompile: EIP-7212, mirrored on rollups as RIP-7212, which lets a smart contract verify a secp256r1 signature at low gas cost. That precompile is what makes a "Face ID wallet" โ an ERC-4337 smart account controlled by biometrics instead of a seed phrase โ economically viable on-chain. So when a headline says "Ethereum Passkey security," the actual load-bearing component is not Ethereum's consensus layer. It is a curve borrowed from a US standards body, an optional precompile, and a phone's security chip.
The "NSA mystery" is older than crypto. NIST's P-curves were published as "verifiably random": the seed is supposed to be the hash of a public string, so anyone can check it. The catch is that the string itself โ the preimage โ was never disclosed. For two decades the parameter set has carried an asterisk, sharpened by Dual_EC_DRBG, the 2006 random-number generator with a suspected NSA backdoor that poisoned the well of trust for an entire generation of standards. Verifiable randomness, it turns out, is only as trustworthy as the disclosure of its inputs. That is the gap Claude reportedly narrowed.
Here is the teardown, stated as plainly as the evidence allows. The claim: Claude reconstructed the preimage behind the P-256 seed, apparently by exploiting a "timestamp recipe" โ a preimage string whose format encodes a date, shrinking the search space to an enumerable set of candidate timestamps. If true, this is a methodologically clever result. It is AI used as a research instrument, a directed search over a structured space. It is not a cryptographic break, and it is not a vulnerability disclosure. It answers one question โ where did the seed come from โ and leaves the harder one untouched.
The harder one is this: even with a recovered preimage, you cannot exclude the possibility that the generator hashed a large batch of candidate strings and selected the one whose resulting curve parameters were most favorable to a party you do not trust. This is the distinction between "verifiably random" and "unquestionably random." Finding the preimage proves the seed is reproducible. It does not prove the seed was not cherry-picked. The provenance evidence narrows the trust gap; it cannot close it. Anyone who reads "reconstructed" as "exonerated" has confused a checksum with a confession.
Now the evidence chain, which is where my skepticism sharpens. What arrived at my desk was not the primary result. It was a vendor statement, filtered through a media write-up, compressed into an aggregation summary. That is three levels of attenuation; each level is a lossy transform. The summary itself hedged โ "supplementary provenance evidence," not "proof of safety" โ which tells me the primary source was more careful than its headline. But the intermediate layers had already done their damage. The phrase "public key seed" was itself imprecise; the seed is public and always has been. What was unknown is its preimage. When a summary cannot distinguish a seed from its preimage, it cannot be trusted to report what was or was not proven. Trust is a variable; verification is a constant. I have no code, no paper, no reproducible script โ only a claim. Until a third party re-runs the search and publishes the hash, the correct posture is "unverified," not "solved."
Kill Switch. The conditions under which this entire narrative fails: (1) the "timestamp recipe" is never disclosed or reproduced, making the claim unfalsifiable vendor marketing; (2) the recovered preimage is shown to be one of many viable candidates, confirming rather than dispelling cherry-picking; (3) the result is quietly folded into a broader "AI can crack cryptography" narrative with no technical follow-up. Any one of these collapses the story from "infrastructure trust improvement" to "promotional content." None of the three has yet been ruled out.
And here is the reality that the headline obscures. The actual attack surface for a Passkey wallet is not the philosophical provenance of the curve. It is the authenticator firmware, the correctness of the precompile contract, and the signature-verification logic of the account-abstraction wallet. Those are auditable; those have failed before; those will fail again. The curve preimage is the least operational risk in the stack and received the most attention. That inversion is the tell.
Let me give the bulls their due, because a good dissector argues against the strongest version, not the weakest. The genuine signal here is not the curve; it is the method. Using a large language model as a directed search engine over structured parameter spaces is a real capability shift. If the technique generalizes โ and a timestamp-formatted preimage is exactly the kind of low-entropy structure it would generalize to โ then a class of "verifiably random" assumptions across standards may become retroactively checkable. That is a slow, quiet, profound development. It does not move a price today; it may rewrite how standards bodies disclose their seeds in five years. The second thing the bulls get right: EIP-7212 is genuinely useful. Cheaper on-chain secp256r1 verification lowers the cost of biometric, seedless accounts, and that is a real UX and security improvement for ordinary users โ independent of whether the seed's provenance is ever fully resolved. Both of these are real. Neither justifies the headline.
The forward question is not whether Claude unpicked a mystery. It is whether anyone will publish the hash, the script, and the candidate set โ so that the claim becomes a fact or a footnote. Until then, the curve is exactly as trustworthy as it was last week, which is to say: as trustworthy as your phone's chip and your wallet's code, and no more. Hype builds the floor; logic clears the debris. The debris, this week, is a solved mystery that solved nothing.