Exactly.

When they made the changes to the s boxes for differential cryptanalysis resistance the entire concept of that was essentially secret, so who knows what they know about elliptic curves.

▲

matthewdgreen 2 hours ago | parent | next [-]

The number of weak classes of elliptic curve would have to be gargantuan for this specific search to produce some. If that many curves are bad, then ECC was a mistake.

	▲	1sha an hour ago \| parent \| next [-]
		drand48() could be one of hundreds of methods that were tried to produce specific values with plausible deniability and happened to produce them. The other searches were discarded.
	▲	fidotron an hour ago \| parent \| prev [-]
		Then why not turn this around and say which (hopefully small set of) specific classes of curves are known to be avoided, but otherwise have a free for all? > If that many curves are bad, then ECC was a mistake. I mean that is the logical conclusion from the behaviour around this approach where a few good things are effectively endorsed without justification. The fact is any application of an algorithm that involves so much "trust me bro" on the selection of what are a large number of opaque quasi random but not quite or provably so numbers only has as much trust in it as you have in the people that created it.

▲

tptacek 2 hours ago | parent | prev [-]

Again, Koblitz and Menezes take this idea on directly in their paper. But I mean, at this point, nobody serious is going to take the P-curve seed conspiracy theory seriously ever again.