Remix.run Logo
Remix clone Hacker News
new | show | ask | jobsGithub
▲ JumpCrisscross 3 hours ago

> which may make them weaker or stronger than some other random numbers

Are there non-trivial weaker and stronger seeds for this category of elliptic curves?

▲fidotron 3 hours ago | parent [-]

Exactly.

When they made the changes to the s boxes for differential cryptanalysis resistance the entire concept of that was essentially secret, so who knows what they know about elliptic curves.

▲matthewdgreen 2 hours ago | parent | next [-]

The number of weak classes of elliptic curve would have to be gargantuan for this specific search to produce some. If that many curves are bad, then ECC was a mistake.

▲1sha an hour ago | parent | next [-]

drand48() could be one of hundreds of methods that were tried to produce specific values with plausible deniability and happened to produce them. The other searches were discarded.

▲fidotron an hour ago | parent | prev [-]

Then why not turn this around and say which (hopefully small set of) specific classes of curves are known to be avoided, but otherwise have a free for all?

> If that many curves are bad, then ECC was a mistake.

I mean that is the logical conclusion from the behaviour around this approach where a few good things are effectively endorsed without justification.

The fact is any application of an algorithm that involves so much "trust me bro" on the selection of what are a large number of opaque quasi random but not quite or provably so numbers only has as much trust in it as you have in the people that created it.

▲tptacek 2 hours ago | parent | prev [-]

Again, Koblitz and Menezes take this idea on directly in their paper. But I mean, at this point, nobody serious is going to take the P-curve seed conspiracy theory seriously ever again.