Comment by tyromaniac
8 hours ago
Yeah... It would only be the second time they tried to do exactly that, with elliptic curve related crypto nonetheless
8 hours ago
Yeah... It would only be the second time they tried to do exactly that, with elliptic curve related crypto nonetheless
If your comparison here is to Dual EC, the two constructions are utterly unalike; you might as well compare it to the DES S-boxes.
Sure, the construction is different, but for all I know, there is a weakness in some subset of curves, and by not using open "nothing up my sleeve" practices for selecting their curves, they invited speculation. My point is that this is an untrustworthy actor who has shown itself to be untrustworthy on many occasions, and that you could make a similar migration argument about that, since it was pushed through FIPS. The fact that it was also EC based was not very relevant, I just thought that was funny.
I'm having trouble understanding what you're arguing here. We now know they essentially did use a nothing-up-my-sleeves seed; they just didn't care enough (it was a very different time) to reveal that.
2 replies →