4 ms·
> and could potentially have a backdoor (like it's precursor, P-256) P-256 is not known to or even suspected to have any backdoors.
by stouset 5y ago
> and could potentially have a backdoor (like it's precursor, P-256)
P-256 is not known to or even suspected to have any backdoors.
- octoberfranklin 5y agoThen I'm sure you can explain where the number c49d3608 86e70493 6a6678e1 139d26b7 819f7e90 came from. http://safecurves.cr.yp.to/rigid.html http://safecurves.cr.yp.to/rigid.html https://credelius.com/credelius/?p=97 https://credelius.com/credelius/?p=97 With Curve25519, by contrast, DJB explains exactly what constraints were imposed (with very solid justifications for each of them) and then proves that Curve25519 is the unique solution to these constraints which minimizes the remaining free coefficient (which maximizes efficiency). NIST should appoint him to be their Czar or something.
- aaronmdjones 5y agoNIST P-256 (and ECDSA in general, to some extent) is widely suspected to have been subverted by NSA, as outlined in the first link in octoberfranklin's response, page 16 of [1], and [2]. [1] https://www.hyperelliptic.org/tanja/vortraege/20130531.pdf https://www.hyperelliptic.org/tanja/vortraege/20130531.pdf [2] https://blog.cr.yp.to/20140323-ecdsa.html https://blog.cr.yp.to/20140323-ecdsa.html "I have a different view. I blame this attack on the ECDSA designers [https://www.nsa.gov/ https://www.nsa.gov/]."