3 ms·

Even with preimage resistance, it seems like it wouldn't be insane to just burn cycles until you got one close enough, bitcoin-style. Dealing with attackers in

• infogulch 5y ago
  My point is that I don't think there's anything during key generation that requires the resulting key to be secure / chosen 'well', so an attacker might exploit key generation as a way to target a particular spot in the line, where having an insecure/easily compromised key doesn't matter to them even though that may be detrimental to the health of the network. But at least with preimage resistance any public key is just as likely as any other to get a particular spot that they desire so there's no incentive to exploit key generation to get it, they might as well generate a bunch of secure keys if they want to use a bitcoin-style brute force strategy.