11 ms·
Why Did Satoshi Decide to Use Secp256k1 Instead of Secp256r1?
- 0des 5y agoWell, for one, iirc Secp256r1 was pseudo random and can be seen glowing in broad daylight.
- snypher 5y agoFrom here[1], even the two a,b values seem suspicious: k curve a = 0 b = 7 r curve a = FFFFFFFF 00000001 00000000 00000000 00000000 FFFFFFFF FFFFFFFF FFFFFFFC b = 5AC635D8 AA3A93E7 B3EBBD55 769886BC 651D06B0 CC53B0F6 3BCE3C3E 27D2604B [1]https://www.johndcook.com/blog/2018/08/21/a-tale-of-two-elliptic-curves/ https://www.johndcook.com/blog/2018/08/21/a-tale-of-two-elli...
- themodelplumber 5y agoGlowing...is this metaphorical or some industry term?
- K0balt 5y ago“Glows” for something tampered with or “glowies”for agents of three letter agencies doing the tampering is an imageboard culture term first coined by Terry Davis (1969-2018), the iconic developer of TempleOS, who made the probably fantastical but apparently not metaphorical claim that he could distinguish CIA agents from regular people because CIA agents “glowed in the dark”. After it’s controversial debut on 4chan, Davis’s unsupported claim of selective unexplained human photoluminescence quickly became a meme in imageboard culture. Since imageboard culture is intersectional with software development culture, the terms have worked their way into defacto terminology among a subset of developers that work on things often thought of as adversarial at times to state interests, encrypted chat and cryptocurrency being among these. The term has bled out some and finds spotty support among other developers in tangential contact. The future of the term is uncertain, as it’s use remains largely isolated despite being canonical since 2017.
- 0des 5y agoSaying that something 'glows in the dark' implies interference, so unfortunately, within cryptography, it has become an industry term as well as metaphor. Other examples are the 'mystery padding' in keccak vs sha3.
- Jensson 5y agoI read the 3 replies and I still don't know what glowing means in cryptographic terms. I even tried to google it with cryptography added but nothing.
- ajb 5y agoIt means that the designer may have inserted an unpublished weakness. See also https://en.m.wikipedia.org/wiki/Nothing-up-my-sleeve_number https://en.m.wikipedia.org/wiki/Nothing-up-my-sleeve_number
- 0des 5y agoAs in the case of Keccak and SHA3, it doesn't necessarily have to be the designer, it can also be the reviewing committee.
- roxaaaane 5y agoIt's probably metaphorical, to mean distinguishable ?! And the term has never been used in crypto
- deleted 5y ago[deleted]
- smoldesu 5y agoIt's imageboard/IRC slang, you won't find any documentation on it because it's an intentionally obfuscated/dogwhistle phrase intended to only 'make sense' to other browsers who've stuck around long enough to get spoonfed.
- sva_ 5y agoIt's a reference to schizophrenic Terry Davis (rip), author of TempleOS, who said CIA agents would glow in the dark, and got popularized through the 4chan /g/ board. https://www.urbandictionary.com/define.php?term=Glows%20in%20the%20dark https://www.urbandictionary.com/define.php?term=Glows%20in%2...
- serf 5y agoweird intersection of the internet. Terry is/was an HN native, too. Upvoting all of his shadowbanned stuff that was half-way decent and lucid was a hobby of mine. It still makes me feel good to think about it. Godspeed Terry. https://news.ycombinator.com/item?id=7818823 https://news.ycombinator.com/item?id=7818823
- deleted 5y ago[deleted]
- jfoutz 5y agoI vouched for a few of his comments as well. I definitely think about how a quirk of biology or environment could flip the wrong switch in my brain. There are millions of sob stories. I don't do as much as I could, but I do more than nothing to help people out. That one, Terry Davis, keeps me up at night sometimes.
- 0des 5y agoHindsight is 20/20, all we can do is learn for next time.
- jcun4128 5y agoI watched some of his live streams, saw some cool things but man the things he would say
- 0des 5y agoIf we were not meant to distinguish creation from creator, we'd be in a world of trouble. Also, he was quite ill, I'm not sure we can fault him for some of his mannerisms while also admiring his ambition and skill.
- collegeburner 5y agoGlowie refers to a fed, it started with the templeos guy but is more general now. Glowing means its a fed op to weaken crypto, kinda like the dual ec fiasco.
- deleted 5y ago[deleted]
- Strilanc 5y agoThey're saying they don't trust that the constants defining the curve were chosen non-maliciously. The NSA has, in the past, standardized protocols that contained intentional backdoors embedded into the constants used in the definition [1]. Because of things like that, it's desirable for cryptographic protocols to use constants chosen in some way that makes backdooring intractable [2]. 1: https://en.wikipedia.org/wiki/Dual_EC_DRBG https://en.wikipedia.org/wiki/Dual_EC_DRBG 2: https://en.wikipedia.org/wiki/Nothing-up-my-sleeve_number https://en.wikipedia.org/wiki/Nothing-up-my-sleeve_number
- jl2718 5y agoIt’s from this t-shirt: https://www.reddit.com/r/lastimages/comments/2obp6s/last_known_image_of_frank_zappa/ https://www.reddit.com/r/lastimages/comments/2obp6s/last_kno... Later the phrase was seen on a t-shirt in a candid photo of a very attractive Japanese woman posted to engrish.com, and went viral. Then 4chan picked it up. And now it’s here.
- matheusmoreira 5y ago4chan's technology board were, let's say, huge fans of Terry Davis, developer of TempleOS. One day during his livestream he said he could see the CIA operators while driving because they would glow in the dark. Now whenever someone is suspected of being an intelligence agency operator, people reply with pictures of a literal glowing person. Usually happens when someone spreads FUD about technology that's believed to be secure. It is assumed that these agencies are running psychological operations in online communites with the intent to dissuade the use of technology that could defeat them.
- sudosysgen 5y agoGlowing in the dark is something people say when they refer to people from intelligence services. The idea is they stick out when doing dark/stealthy stuff.
- fidesomnes 5y agotop reply of the year.
- pluc 5y agoplease refer to him as The Enlightened One
- woliveirajr 5y ago> These curves were chosen actually for efficiency not security Isn't this enough?
- darig 5y ago"efficiency" means not having to deal with federal goons and NDAs, and instead do what they say before your family is suicided.
- sparkie 5y agoBeing powers of 2 is more efficient because computer memory/buses/caches are aligned to those sizes. It does not necessarily imply that they are less secure than with fields of non-power-of-2 sizes. There might even be a security benefit to having these canonical sizes because it simplifies implementation and makes it easier to perform constant-time operations across different hardware. If you consider that some hardware has additional costs to reading non-aligned memory, you open up the possibility for timing-attacks and other implementation bugs brought about by additional complexity. Sometimes simple is better.
- AlexCoventry 5y ago> secp256k1 is a Koblitz curve which is defined in a characteristic 2 finite field, Secp256k1's base field size is a 256-bit prime. What does he mean?
- gizmo686 5y agoThe bitcoin wiki explicitly says that secp256k1 is not characteristic 2: > secp256k1 has characteristic p, it is defined over the prime field ℤp. Some other curves in common use have characteristic 2, and are defined over a binary Galois field GF(2^n), but secp256k1 is not one of them. https://en.bitcoin.it/wiki/Secp256k1 https://en.bitcoin.it/wiki/Secp256k1
- sentinel 5y agoAny recommendations for courses or books that give a 101 intro all the way to understanding these curves and why / how they are used? I'd like to get a grasp on this from first principles. Thank you!
- roxaaaane 5y agoHankerson, Menezes, Vanstone [1] covers almost everything about Elliptic Curves and ECC (Theory and Implementation) [1]:https://cacr.uwaterloo.ca/ecc/ https://cacr.uwaterloo.ca/ecc/
- deleted 5y ago[deleted]
- flixic 5y agoThis is a pretty good intro article: https://andrea.corbellini.name/2015/05/17/elliptic-curve-cryptography-a-gentle-introduction/ https://andrea.corbellini.name/2015/05/17/elliptic-curve-cry...
- R0b0t1 5y agoWikipedia, honestly. For background math you may want to rely on the citations or other provided texts but a lot of articles have great examples sections. But... I think you need a more coherent goal than just "understand the math." You can superficially understand the math when guided, but without any reason to retain it I am not sure what you will gain from the experience.
- tdeck 5y ago> You can superficially understand the math when guided, but without any reason to retain it I am not sure what you will gain from the experience. This has been my experience with almost everything I ever learned about math, much of which I have unfortunately not retained.
- kebman 5y agoOn my journey into this secret world I sadly had to conclude that understanding of the needed math was severely lacking, and that I'd have to start far back to ever get a grasp on it. But on the flipside it has motivated me to learn a bunch of things I never thought I would when I was younger, and also to program things that I never in my life thought I'd be able to.
- nullc 5y agoGarbage spam page. This shouldn't be on HN. There is a common trend for people to take highly technical subjects do a tiny amount of research and then spam up some page (often full of plagiarism) in order to add bulk to their sites. This is especially common in the "defi / ico" fraud ecosystem. In this case the article is so poorly researched that even though it says fairly little it manages to make outright false claims about basic facts, e.g. "secp256k1 is a Koblitz curve which is defined in a characteristic 2 finite field, while secp256r1 is a prime field curve"-- which is false, secp256k1 uses a prime field.
- MichaelZuo 5y agoThanks for the heads up. Do you have a list of known shady sites, or are there too many popping up to keep up with? Or perhaps to rephrase, are there are any trustworthy sites covering similar topics?
- modeless 5y agoBecause this isn't getting enough attention, let me point out that nullc is Gregory Maxwell, Bitcoin core developer. The parent comment is the most informed comment here and you should upvote it.
- nullc 5y agoWell, I'm not actually answering the question. :) (and former Bitcoin developer would be more accurate!) Really people can mostly just speculate on the subject, or offer why they might have chosen it: Satoshi never said much about his choice-- he certainly never said in public that he was concerned with NSA tampered parameters. I think it was a good choice at the time, esp. now after the expiration of the GLV patent. And the fact that there is no opportunity for NSA tampering scaremongering is a nice feature, but that's my opinion and I have no reason to believe it was Satoshi's.
- darthvoldemort 5y agoI wonder if you could track down who Satoshi is based on someone's search queries about Secp256k1 specifically
- tediousdemise 5y agoThis is dark… I bet Satoshi is also a regular user of this website.
- tim333 5y agoI rather doubt it.
- vbezhenar 5y agoIf he was careful, probably he would have used Tor for his searches. But I think that NSA-level organization knows who Satoshi is. It's hard to imagine how one would be able to work on such a project, without any background that could be tracked.
- willbudd 5y agoIt's not that hard if you're careful. The last line of defence of using a well-chosen set of WiFi hotspots, auto-generated MAC addresses, and an otherwise silent Linux distro is pretty impenetrable even if all other proxy layering is somehow compromised. Provided you're disciplined enough to properly containerize all ongoing sessions, of course. Careful planning is all it takes.
- janmo 5y agoThe article basically says that Satoshi went for secp256k1 because for secp256r1 the constants were defined by the NIST under the possible influence of the NSA. I don't think it is a good argument, I invite every one to take a look at the DES S-Box constants. Many people believed that those were backdoor constants that the NSA planted into the algorithm as there was no explanation on how and why they were chosen. Many years later it turned out that they were picked carefully to protect against differential-linear attacks. An attack only the NSA knew back then. So they gave out safe S-Box constants, and all those who distrusted them and picked random/other S-Boxes were actually screwed, this is really ironic. https://en.wikipedia.org/wiki/S-box https://en.wikipedia.org/wiki/S-box
- dan-robertson 5y agoRight except on the other hand, look at the whole Dual_EC_DRBG fiasco where the NSA gave instructions for how one could pick parameters, but also offered their own suggestion (in some standards, one had to use the suggested parameters.) The bit about choosing parameters suggests that the NSA didn’t have a benevolent reason to choose those parameters, and the evidence of that algorithm being exploited in the wild suggests that the NSA may have chosen their parameters with that exploit in mind.
- janmo 5y agoThe way the Dual_EC_DRBG backdoor worked is that only they (the NSA) could exploit it, they had the equivalent of a master private key. The NSA has a track record of never putting out Cryptography that could be broken by any other actor than the NSA itself.
- hutzlibu 5y ago"of never putting out Cryptography that could be broken by any other actor than the NSA itself. " If the only obstacle for others is "unknown Math" - then surely you can rule the script kiddies out, but I believe there are quite some other clever people with strong Math background around, who do not work exclusively for the NSA.
- egberts1 5y agok for konstant?
- forty 5y agoIf you are interested in comparing curves, here is the djb page on the topic https://safecurves.cr.yp.to/index.html https://safecurves.cr.yp.to/index.html
- tromp 5y agoI wonder if anything is known about the choice of base point, which in compressed form is: G = 02 79BE667E F9DCBBAC 55A06295 CE870B07 029BFCDB 2DCE28D9 59F2815B 16F81798 Is this choice beneficial for efficiency? If the choice of G doesn't matter, why not choose it as having the smallest possible x coordinate? Many applications use a second generator H, which must be an unknown multiple of G. This is achieved by defining it as essentially SHA256(G).