Comment by j16sdiz

> The problem with Dual EC isn't the sketchy "constants", but rather the structure of the construction

It's both.

It is bad enough even without the constants

https://blog.cryptographyengineering.com/2013/09/18/the-many...