3 ms·
Good point, forgot how brittle the other curves were. I believe many require unbiased randomness or something? > I haven't spoken to a cryptographer who belie
by loup-vaillant 10y ago
Good point, forgot how brittle the other curves were. I believe many require unbiased randomness or something?
> I haven't spoken to a cryptographer who believes the NIST curves are backdoored
From what I can infer, I would say this is highly unlikely. That still leaves enough room for things to be interesting, so… nope. I won't touch NIST curves willingly with my current knowledge.
- tptacek 10y agoNo, the NIST curves simply can't use random strings as points at all: randomly chosen vectors can be points that aren't valid on the intended curve, but rather on curve of much smaller order; repeatedly submitting insecure curve points can allow attackers to recover private keys via CRT. It's a pretty awesome attack and not hard to implement in a test environment. The unbiased randomness issue is with the ECDSA construction, which requires a totally, uniformly random k value for every signature. Bernstein's Ed25519 construction is deterministic, and doesn't have this problem.