Cryptography
Source reports covering Cryptography. Stories will appear when analysis and community reactions are ready.
10 reports · page 1 of 1
Connected topics are temporarily unavailable. You can still browse stories below.
Source reports
The NIST Elliptic Curves Seeds Bounty Has Been Claimed
news
6 min read
A team from Anthropic has reconstructed how the seeds for NIST’s widely used P-192, P-224, P-256, P-384 and P-521 elliptic curves were generated. John Wood, Henry de Valence, Ava Howell, Zack Voase, Lucy Sweet, Amir Omidi, Paul Crowley, Iain McGinniss, Nicholas Carlini and Steve Weis claimed a three-year-old bounty on October 15, 2026. The team donated the $36,864 prize to the Internet Security Research Group, which operates Let’s Encrypt. NIST published the curves in FIPS 186-2 in 2000 after deriving parameters from SHA-1 hashes of arbitrary seeds under the ANSI X9.62 procedure. The seeds were generated in 1997–98 by initializing the POSIX drand48 pseudorandom-number generator with UNIX timestamps, generating 20-byte candidate seeds, and accepting candidates that produced valid curves. A Go reimplementation verified the reconstruction. The process also rejected candidates whose group-order bit length exceeded the base field’s bit length, but an additional unexplained filter appears to have excluded roughly half of otherwise valid seeds. The reconstructed timestamp-based process substantially limits the freedom available to choose curve parameters. The source estimates that selecting any 1997–98 timestamp and one of the first 16 prime-order candidates would provide fewer than 30 bits of choice, ruling out a previously proposed technique requiring 70 bits of seed-selection freedom to target a hypothetical class of weak curves.
Claude reveals ECDSA curve origins
research
12 min read
Anthropic says Claude identified how the unexplained seed values behind major NIST elliptic-curve cryptography standards were generated. In under half an hour in October 2026, an internal research model determined that seeds for NIST P-192, P-224, P-256, P-384 and P-521 were outputs of the legacy C-library lrand48 pseudorandom-number generator initialized with Unix timestamps, rather than hashes of secret phrases or other cryptographic algorithms. NIST adopted these curves in 2000 for the FIPS 186-2 Digital Signature Standard, while the NSA had supplied their seed values without explaining their provenance. Anthropic reconstructed timestamps from May 1997 through April 1998 and the candidate positions that reproduce ten prime-curve and binary-curve seeds; P-256, for example, was the 1,842nd 20-byte candidate from its run. Anthropic says the result is not a cryptographic break or a newly discovered weakness, and that the simple reproducible process makes intentional backdoors less plausible. Claude also traced base points for P-192 and five ANSI X9.62 example curves to the FreeLIP random-number generator, but could not explain base points for P-224, P-256, P-384, P-521 or NIST binary curves. B-163 remains unexplained. Anthropic will donate the $36,864 NIST elliptic-curve seeds bounty to the Internet Security Research Group.
C2PA Cameras Do Not Survive Contact with Reality
opinion
10 min read
Security researcher David Buchanan said Android implementations of C2PA, a media-provenance standard intended to cryptographically identify camera-captured content, can be made to sign arbitrary AI-generated images and videos after a device is rooted. He demonstrated media that C2PA verification identified as originating from Google’s Pixel Camera app and said a YouTube label initially described a forged video as “captured with a camera.” Google later removed that section of the video description, Buchanan said. Android C2PA camera apps rely on Key Attestation or Google Play Integrity to prevent altered apps from signing non-camera data. Buchanan said privilege-escalation exploits can root a device without unlocking its bootloader or modifying its verified boot keys, allowing a compromised but apparently compliant device to obtain C2PA signing keys. StrongBox hardware prevents extraction of those keys, but root access can instruct StrongBox to sign arbitrary data, he said. Buchanan cited CVE-2026-43499 as an in-the-wild one-click root exploit affecting fully patched Pixel devices at the time of publication, August 25, 2026. He also said low-cost hardware fault-injection attacks can root devices and may not be patchable on existing hardware. Google awarded Buchanan a $7,500 bounty despite closing his report as “Won’t fix (infeasible),” according to Buchanan.
LLMs won't break symmetric crypto
research
6 min read
Anthropic's LLM Claude Mythos has discovered key-recovery attacks on HAWK, a post-quantum signature scheme candidate. While the attack is impractical for most versions of HAWK, it significantly reduces the security of the toy version HAWK-256, which has 64-bit security that is nearly breakable.
Anthropic publishes a practical key-recovery attack on HAWK-256
tool
1 min read
The GitHub repository for anthropics/cryptography-research-demo contains cryptanalysis code related to published research papers. It features three independent components: AES, HAWK, and LEA, and is licensed under Apache 2.0.
Discovering Cryptographic Weaknesses with Claude
research
18 min read
Researchers at Anthropic have utilized Claude Mythos Preview to uncover vulnerabilities in cryptographic algorithms. One attack significantly compromises the HAWK digital signature scheme, while another reveals a new method to exploit round-reduced AES, a widely used symmetric cipher.
AI Meets Cryptography 2: What AI Found in OpenVM's ZkVM
research
13 min read
AI auditor zkao identified a critical soundness bug in OpenVM's zkVM guest library openvm-pairing, allowing a malicious prover to forge any pairing equality. This vulnerability does not affect the zkVM's proving system itself but impacts code relying on the flawed library.
AI Meets Cryptography 1: What AI Found in Cloudflare's Circl
tool
19 min read
An AI audit pipeline identified seven bugs in Cloudflare's CIRCL cryptography library, including a critical float64 precision loss in threshold RSA and a complete access-control breach in attribute-based encryption. All identified vulnerabilities have been fixed upstream.
NSA and IETF: Fairness
research
11 min read
Secret NSA documents reveal that the agency promoted the Data Encryption Standard (DES) in the 1970s despite knowing its vulnerabilities to eliminate competition. The NSA also exploited export-law exceptions in the 1990s to favor RC4 and RSA-512, compromised random number generator standards, and maintained a substantial budget to influence security standards through the 2010s.
A Cryptography Engineer's Perspective on Quantum Computing Timelines
opinion
11 min read
Recent developments indicate significant progress in the field of cryptographically-relevant quantum computers. This has prompted a shift in urgency regarding the implementation of quantum-resistant cryptography.