3 ms·
With a tiny number of exceptions, Bitcoin private keys are just random sequences of 256 bits. They don't involve primality. So unless a shared CRNG is truly awf
by sowbug 8y ago
With a tiny number of exceptions, Bitcoin private keys are just random sequences of 256 bits. They don't involve primality. So unless a shared CRNG is truly awful, there shouldn't be any reason why keys would cluster around certain values.
- tptacek 8y agoWhich is basically the thesis of the underlying "Ron Was Wrong Whit Was Right" paper --- that discrete log systems are safer than RSA. Since then, there's been more work done on the pitfalls of prime generation, perhaps most notably the "Prime And Prejudice" paper, which is really excellent and more interesting technically than this article: https://eprint.iacr.org/2018/749.pdf https://eprint.iacr.org/2018/749.pdf New systems should generally avoid RSA, for this reason among several others.
- pbsd 8y agoIsn't the point of "Prime and Prejudice" that primality tests that are perfectly adequate for RSA key generation are inadequate to verify the primality of adversarial inputs, in protocols like negotiated DHE or whatnot?
- tptacek 8y agoDammit. I just wanted a cool link to Prime and Prejudice! You're right, of course.
- AlexCoventry 8y ago> generally avoid RSA, for this reason among several others. What are the others?