An in-depth examination of Claude signatures demonstrates that the so-called encrypted reasoning blocks are ordinary protobuf structures rather than opaque blobs. The 428-character base64 signature decodes to 319 bytes that begin with a zero byte and follow standard protobuf wire formats.
The outer message contains three fields: a varint indicating schema version 2, a 312-byte length-delimited inner message, and another stable varint flag. Inside the inner message the layout is consistent across thousands of samples: a 135-byte header, two 12-byte nonce fields, a 48-byte MAC, and the variable-length ciphertext.
The header, parsed without any decryption keys, contains several plaintext fields. Field 6 stores the model identifier such as claude-opus-5. Field 8 stores the block type string thinking. Field 11 stores the 36-character organizationUuid taken directly from the user's Anthropic account configuration. These values are covered by the MAC yet remain readable to anyone who can decode the base64 and walk the protobuf tree.
Only the ciphertext in field 5 is encrypted. Its length equals the original reasoning text plus exactly 16 bytes, confirming standard AES-GCM usage with no padding or compression. When the visible thinking field is empty, the ciphertext length still reveals the true length of the model's internal reasoning.
Protocol evolution across four versions added the model name in v12, the block-type string in v13–v14, and the organization identifier in v15. The same parser written six months earlier continues to decode current Opus-5 blocks without modification.
The presence of organization and model identifiers inside the signed header allows a server to reject attempts to replay an Opus block to a Haiku instance belonging to a different account. At the same time, the same identifiers leak account linkage when users publish agent logs containing the raw signatures.
