3 ms·

> At the time, the "pass a string through SHA1" thing was meant to increase confidence in the curve seeds; the idea was that SHA1 would destroy any possible str

> At the time, the "pass a string through SHA1" thing was meant to increase confidence in the curve seeds; the idea was that SHA1 would destroy any possible structure in the seed, so NSA couldn't have selected a deliberately weak seed. It's standard to use transcendental constants like pi or e for this purpose as you can't select them. A phrase could in theory be selected to yield a more desirable hash

tedunangst 3y ago
What do you if pi doesn't create a nice curve?
- some_furry 3y ago
  Doesn't pi by definition make a nice curve? (Dumb geometry joke, sorry. I know what you mean.)
- kevincox 3y ago
  You come up with a hopefully simple rule to try again. Like skip the first byte and try again. Assuming that you publish your definition of "a nice curve" then third parties can verify that you used the first offset in pi that worked.
  - tedunangst 3y ago
    Ah, of course, just drop bits until it "happens" to work. You would suggest that, instead of the simple and obvious solution of using pi times e.
  - quickthrower2 3y ago
    You could however test different schemes like this prior to announcing the scheme.
    - Dylan16807 3y ago
      There's only so much room for simple methods. So maybe you get to pick the most crackable for you out of 25 options. But you can't hide a proper backdoor like that.
      - duskwuff 3y ago
        And if it's possible to get an easy-to-break configuration in a relatively small number of attempts, it's probably because there's something fundamentally broken about the entire construct, not just the seed you picked. And that sort of brokenness is likely to be a lot harder to hide.
jancsika 3y ago
> It's standard to use transcendental constants like pi or e for this purpose as you can't select them. If one may choose between one or the other without arousing suspicion, that's one bit of entropy. If I can add the possibility of sin(1) and cos(1), that's two bits. And remind me: are we using sha1, or md5? Or perhaps sha1 -> md5, or md5 -> sha1? And so on, until I have enough bits to reimplement the suspicious seed in the cracks of all these innocuous, and very poorly specified "standard" choices. Dan Bernstein (and some other cryptographer?) wrote about this and did a demo creating over a million curves in a short/practical amount of time on commodity hardware. All of them had seeds specified using a "standard" method like what you mention above. It makes me think all cryptographers ought to just go ahead and choose suspicious seeds where prudent, kinda like if you're going to play the lottery, just go ahead and choose the numbers 1 2 3 4 5 etc. At least then you get instant, free information about the lack of knowledge of the people who complain that you're doing it wrong.

tedunangst 3y ago

What do you if pi doesn't create a nice curve?

some_furry 3y ago
Doesn't pi by definition make a nice curve? (Dumb geometry joke, sorry. I know what you mean.)
kevincox 3y ago
You come up with a hopefully simple rule to try again. Like skip the first byte and try again. Assuming that you publish your definition of "a nice curve" then third parties can verify that you used the first offset in pi that worked.
- tedunangst 3y ago
  Ah, of course, just drop bits until it "happens" to work. You would suggest that, instead of the simple and obvious solution of using pi times e.
- quickthrower2 3y ago
  You could however test different schemes like this prior to announcing the scheme.
  - Dylan16807 3y ago
    There's only so much room for simple methods. So maybe you get to pick the most crackable for you out of 25 options. But you can't hide a proper backdoor like that.
    - duskwuff 3y ago
      And if it's possible to get an easy-to-break configuration in a relatively small number of attempts, it's probably because there's something fundamentally broken about the entire construct, not just the seed you picked. And that sort of brokenness is likely to be a lot harder to hide.

jancsika 3y ago

> It's standard to use transcendental constants like pi or e for this purpose as you can't select them. If one may choose between one or the other without arousing suspicion, that's one bit of entropy. If I can add the possibility of sin(1) and cos(1), that's two bits. And remind me: are we using sha1, or md5? Or perhaps sha1 -> md5, or md5 -> sha1? And so on, until I have enough bits to reimplement the suspicious seed in the cracks of all these innocuous, and very poorly specified "standard" choices. Dan Bernstein (and some other cryptographer?) wrote about this and did a demo creating over a million curves in a short/practical amount of time on commodity hardware. All of them had seeds specified using a "standard" method like what you mention above. It makes me think all cryptographers ought to just go ahead and choose suspicious seeds where prudent, kinda like if you're going to play the lottery, just go ahead and choose the numbers 1 2 3 4 5 etc. At least then you get instant, free information about the lack of knowledge of the people who complain that you're doing it wrong.