3 ms·
They say coefficient b is determined via BLAKE3, but unless I'm missing it, they don't actually say how? They also claim that the prime modulus was chosen "car
by Retr0id 2y ago
They say coefficient b is determined via BLAKE3, but unless I'm missing it, they don't actually say how?
They also claim that the prime modulus was chosen "carefully", and enumerate its favourable properties, but do not elaborate on how it was chosen. Presumably they had some code that looped until they found a prime that gave them all the right properties, but it would be good if they shared that process.
- GoblinSlayer 2y agoHere is b: https://github.com/victormeloasm/OpenFrogget/blob/main/src/eccfrog512ck2.cpp https://github.com/victormeloasm/OpenFrogget/blob/main/src/e...
- quesomaster9000 2y agoAnd even with the constant `b=BLAKE("ECCFrog512CK2 forever")` there is an open question, while not as problematic as it is with the NIST & SEC curves, it's covered in "How to manipulate curve standards: a white paper for the black hat"[1] I'm surprised they didn't include the constant in the paper and at least a short justification for this approach, despite stating "This ensures reproducibility and verifiable integrity" in section 3.2, whereas several other curves take the approach of 'smallest valid value that meets all constraints'. Really they should answer the question of "Why can't `b` be zero... or 1" if they're going for efficiency, given they're already using GLV endomorphisms. Likewise with the generator, I see no code or mention in the paper about how they selected it. [1]: https://eprint.iacr.org/2014/571.pdf https://eprint.iacr.org/2014/571.pdf