2 ms·

It doesn't need to be. The group you're using is part of the cryptosystem, not part of the key.

baby 11y ago
And the cryptosystem might be backdoored by the way you choose the constants. (they are way too many constants to choose from)
- tptacek 11y ago
  It really isn't backdoored, though. Bada55 made a legit point that curves shouldn't be required to derive from simple math constants, but it does less of a good job showing that math constants are themselves necessarily untrustworthy. You'd need an awfully funky looking set of constants to get the degree of freedom bada55 proposes.
- cperciva 11y ago
  Right. Hence "nothing up my sleeve" numbers. It's hard to fit a backdoor into Pi.
  - baby 11y ago
    Why did you choose Pi? And not e? (see what I'm doing?)
    - tptacek 11y ago
      Because pi is the simplest constant that has already been used as a magic constant in other cryptographic algorithms. Next question?
      - baby 11y ago
        That's completely not true. Example sha-1: > The constant values used are chosen to be nothing up my sleeve numbers: the four round constants k are 230 times the square roots of 2, 3, 5 and 10. The first four starting values for h0 through h3 are the same with the MD5 algorithm, and the fifth (for h4) is similar.
        tptacek 11y ago
        230 times the square roots of 2, 3, 5 and 10 versus the first N digits of Pi, minus the leading 3 (what Blowfish used).
        baby 11y ago
        other examples: https://news.ycombinator.com/item?id=11161841 https://news.ycombinator.com/item?id=11161841
        tptacek 11y ago
        Look at the BLAKE example there: it's simply the leading digits of pi. The rest of the examples seem like they prove my point. 1/pi? sin(n)? First N primes? Cubes of first N primes? I agree! Super sketchy! Why would you use any of those? Just use pi.
        baby 11y ago
        WAT, there was no pi in that list
        pbsd 11y ago
        You probably don't want to use BLAKE as the poster child for this argument, since it uses two sets of constants of distinct provenance: the initialization vector, which uses the same constants as SHA-2, i.e., the square roots of the first 8 primes, and the constants used in the compression function, which are indeed the expansion of pi. BLAKE2 got rid of the pi constants.
  - wglb 11y ago
    I used to think so until I read Carl Sagan's Contact.

baby 11y ago

And the cryptosystem might be backdoored by the way you choose the constants. (they are way too many constants to choose from)

tptacek 11y ago
It really isn't backdoored, though. Bada55 made a legit point that curves shouldn't be required to derive from simple math constants, but it does less of a good job showing that math constants are themselves necessarily untrustworthy. You'd need an awfully funky looking set of constants to get the degree of freedom bada55 proposes.
cperciva 11y ago
Right. Hence "nothing up my sleeve" numbers. It's hard to fit a backdoor into Pi.
- baby 11y ago
  Why did you choose Pi? And not e? (see what I'm doing?)
  - tptacek 11y ago
    Because pi is the simplest constant that has already been used as a magic constant in other cryptographic algorithms. Next question?
    - baby 11y ago
      That's completely not true. Example sha-1: > The constant values used are chosen to be nothing up my sleeve numbers: the four round constants k are 230 times the square roots of 2, 3, 5 and 10. The first four starting values for h0 through h3 are the same with the MD5 algorithm, and the fifth (for h4) is similar.
      - tptacek 11y ago
        230 times the square roots of 2, 3, 5 and 10 versus the first N digits of Pi, minus the leading 3 (what Blowfish used).
        baby 11y ago
        other examples: https://news.ycombinator.com/item?id=11161841 https://news.ycombinator.com/item?id=11161841
        tptacek 11y ago
        Look at the BLAKE example there: it's simply the leading digits of pi. The rest of the examples seem like they prove my point. 1/pi? sin(n)? First N primes? Cubes of first N primes? I agree! Super sketchy! Why would you use any of those? Just use pi.
        baby 11y ago
        WAT, there was no pi in that list
        pbsd 11y ago
        You probably don't want to use BLAKE as the poster child for this argument, since it uses two sets of constants of distinct provenance: the initialization vector, which uses the same constants as SHA-2, i.e., the square roots of the first 8 primes, and the constants used in the compression function, which are indeed the expansion of pi. BLAKE2 got rid of the pi constants.
- wglb 11y ago
  I used to think so until I read Carl Sagan's Contact.