5 ms·

> Now, we've known for a long time that we want rigid curve generation >A rigid curve standard can generate only one or a very few curves. A non-rigid generati

> Now, we've known for a long time that we want rigid curve generation >A rigid curve standard can generate only one or a very few curves. A non-rigid generation procedure might generate millions or billions of different curves. That's bad news, because it means that corrupt standards bodies can search those billions of curves for one with a weakness that only they know about. This looks like a contradiction. It wouldn't surprise me in the least if every concrete function had some degree of weakness, and if finding that weakness requires vast computational resources, then we hardly need corrupt standards bodies to find them in advance. Can you square this circle for me, Thomas?

tptacek 11y ago
Say NSA knows about a weakness --- perhaps something that requires an additional parameter check when receiving a point on a curve --- that comes up in only 1 out of every 1,000,000 generated curves of a particular form. The worry is that NSA could come up with a set of possible "first principles" mathematical constants and search through 1,000,000 permutations of those constants to find that 1 weak curve. Then they'd write a standard suggesting that the permutation they chose follows naturally from mathematics, and their starting point was selected to be transparent and to guarantee that they hadn't manipulated the standard to weaken it. Obviously, they've done the very opposite thing, but the point of BADA55 is that you can manipulate standards surreptitiously this way. The point isn't that it's possible to find weak curves. Of course it is possible to do that.