Comment by schiffern

  >even if we assume they tried all timestamps of 1997

Why limit to that? Especially since the official history had it as "hashed passphrase" (which would, of course, provide ample entropy).

A confusing official story doesn't disprove anything. If anything, that would be standard operating procedure for a signals intelligence plant.

  >Finding out there is a class of weak 256-bit elliptic curves so large that they can be hit randomly with 2^30 tries would be a cryptanalytic breakthrough 

NSA is the largest employer of mathematicians in the world.

A breakthrough would indeed be a terrible thing to waste. If I had one, I'd make a good and boring official cover story, and stick to it! Regular old spy-craft stuff, in other words. ;)