While this confirms the method of production it doesn't say anything about their selection, especially since they were, apparently, generated over a period of months. Specifically you cannot see those candidates that were generated and discarded.

"It is still conceivable that these curves were selected to have a specific property in principle by searching over timestamps to the random number generator."

Yes.

"However, you would only need to do that if you were going to disclose the timestamp as some evidence that the seed was innocuously generated."

Does not logically follow when "doing and saying nothing" will completely suffice.

Given how expensive this computation would have been in 1997, it makes perfect sense they'd taken months, but even if we assume they tried all timestamps of 1997 and selected arbitrarily among the first 16 viable candidate for each timestamp, that's just ~30 bits of freedom.

Finding out there is a class of weak 256-bit elliptic curves so large that they can be hit randomly with 2^30 tries would be a cryptanalytic breakthrough analogous to discovering all elliptic curve cryptography is broken.

Read section 3.1 of the Koblitz and Menezes paper. It was already implausible with 160 bits of freedom. https://eprint.iacr.org/2015/1018

If you want to believe the NSA knows ECC is broken and chose to risk moving the US government to it and somehow no one figured out the same break in 30 years, you're free to do so. But pretending the seed choice plays any role in that theory is over.

I think it does rule out any NOBUS vulnerability with these curves, doesn't it? My thinking may be a bit sloppy here, but for a curve to be NOBUS exploitable with N-bit security by its creators, I think it would have to have a property only shared by 1/(2^N) curves. It would be impractical to hash 2^(N-1) timestamps until you find one with the desired property, for any decent size of N--which is how many you'd have to do on average before finding one with that property.

> While this confirms the method of production it doesn't say anything about their selection, especially since they were, apparently, generated over a period of months. Specifically you cannot see those candidates that were generated and discarded.

Well, at least now we have a way to perform that analysis! Generate a bunch of curves by varying (along any degree of freedom) the input parameters to the seed generating function and see if there's any difference between the curves that are generated.

God bless you for keeping this alive.

If you keep posting like this you're gonna get microwaved from space ;)

"However, you would only need to do that if you were going to disclose the timestamp as some evidence that the seed was innocuously generated."

And the disclosure happened now through Anthropic that is 100% not going to anger the NSA before the IPO and will have permission.