The link just points at the Brainpool curves, but the paper describing the 'new curves' etc is lots of fun. (http://bada55.cr.yp.to/pubs.html http://bada55.cr.y

The link just points at the Brainpool curves, but the paper describing the 'new curves' etc is lots of fun. (http://bada55.cr.yp.to/pubs.html http://bada55.cr.yp.to/pubs.html, How to manipulate curve standards: a white paper for the black hat.) It takes a swipe at the wider issue of how a procedure for picking constants like Brainpool's can be gamed, by using a template procedure with lots of 'justifiable' choices - the hash function, the seed, etc, but only presenting the one that leads to your 'known-weak' curve. Our experience is that Alice and Bob, when faced with a single procedure such as [BADA55-VPR's] (or [Brainpool's]), find it extremely difficult to envision the entire space of possible procedures (they typically see just a few dimensions of flexibility), and find it inconceivable that the space could have size as large as 2^20, never mind 2^30. (s5.3) I find it pretty hilarious that someone found a way to weaponize the old quote "The wonderful thing about standards is that there are so many of them to choose from"