Comment by fidotron
2 days ago
Exactly.
When they made the changes to the s boxes for differential cryptanalysis resistance the entire concept of that was essentially secret, so who knows what they know about elliptic curves.
2 days ago
Exactly.
When they made the changes to the s boxes for differential cryptanalysis resistance the entire concept of that was essentially secret, so who knows what they know about elliptic curves.
The number of weak classes of elliptic curve would have to be gargantuan for this specific search to produce some. If that many curves are bad, then ECC was a mistake.
drand48() could be one of hundreds of methods that were tried to produce specific values with plausible deniability and happened to produce them. The other searches were discarded.
That could be a valid suspicion if the RNG chosen was particularly obscure. drand48 isn't - it's part of the standard C library.
Not really plausible if it was used for all the curves.
Then why not turn this around and say which (hopefully small set of) specific classes of curves are known to be avoided, but otherwise have a free for all?
> If that many curves are bad, then ECC was a mistake.
I mean that is the logical conclusion from the behaviour around this approach where a few good things are effectively endorsed without justification.
The fact is any application of an algorithm that involves so much "trust me bro" on the selection of what are a large number of opaque quasi random but not quite or provably so numbers only has as much trust in it as you have in the people that created it.
Again, Koblitz and Menezes take this idea on directly in their paper. But I mean, at this point, nobody serious is going to take the P-curve seed conspiracy theory seriously ever again.