> It's standard to use transcendental constants like pi or e for this purpose as you can't select them. If one may choose between one or the other without arou

> It's standard to use transcendental constants like pi or e for this purpose as you can't select them. If one may choose between one or the other without arousing suspicion, that's one bit of entropy. If I can add the possibility of sin(1) and cos(1), that's two bits. And remind me: are we using sha1, or md5? Or perhaps sha1 -> md5, or md5 -> sha1? And so on, until I have enough bits to reimplement the suspicious seed in the cracks of all these innocuous, and very poorly specified "standard" choices. Dan Bernstein (and some other cryptographer?) wrote about this and did a demo creating over a million curves in a short/practical amount of time on commodity hardware. All of them had seeds specified using a "standard" method like what you mention above. It makes me think all cryptographers ought to just go ahead and choose suspicious seeds where prudent, kinda like if you're going to play the lottery, just go ahead and choose the numbers 1 2 3 4 5 etc. At least then you get instant, free information about the lack of knowledge of the people who complain that you're doing it wrong.