> and presumably nobody would try to brute-force a private key.

Why not? There are examples of RNGs providing very poor entropy which might be a reason to check it (looking at you Sony).

▲

nmeofthestate 7 hours ago | parent [-]

Just seems weird for anyone to focus on trying to crack private keys starting with absurd 8-bit values that "nobody would use for a private key", let alone bother to do it at all, given the search space.

▲

consp 7 hours ago | parent | next [-]

I would not expect anyone to be on the lookout continuously, but like the researcher doing a "yolo" and trying. There are enough people out there that it is likely to happen at least once in a while. Or for instance someone looking for a firmware exploit in a downstream device.

▲

smaudet 5 hours ago | parent | prev | next [-]

And here you learn why security is often just theater (not saying a proper elliptic key is theater)...

It took less than a second to factor this key. Why not attempt, say, to factor every CA, with a budget of less than a minute each?

The reward/risk ratio is skewed so heavily in favor of trying, the only reason not to is this idea that it is "impossible".

It's clearly not, hence, the theater. Your locks don't have to work, they often only have to look like they work...

	▲	cowlevel 16 minutes ago \| parent [-]
		Factoring is for RSA. The best non-quantum attack against ECDSA is meet-in-the-middle brute force, with sqrt complexity. With RSA you can check if any keys in the world have any low factors and that might be interesting to do, even if you don't get any complete keys. With ECDSA the search is all or nothing and without an obvious starting point.

▲

6 hours ago | parent | prev [-]

[deleted]