3 ms·
What's HN's attitude towards SafeCurves[1]? I know djb knows his stuff, but the very binary "safe" / "unsafe" breakdown seems a bit dubious. gmaxwell wrote a ni
by aftbit 12y ago
What's HN's attitude towards SafeCurves[1]? I know djb knows his stuff, but the very binary "safe" / "unsafe" breakdown seems a bit dubious. gmaxwell wrote a nice forum post[2] explaining why secp256k1 is safe for Bitcoin despite its inclusion in the unsafe curves list.
[1]: http://safecurves.cr.yp.to/ http://safecurves.cr.yp.to/
[2]: https://bitcointalk.org/index.php?topic=380482.msg4083612#msg4083612 https://bitcointalk.org/index.php?topic=380482.msg4083612#ms...
- AlyssaRowan 12y agoIt's a perfectly fine set of criteria for best practices in defining modern elliptic curves, imho. Focus is on the simplicity of correct implementations, and on trying to avoid manipulatable variables. However, I do not on balance think the NIST curves secp256r1 and secp384r1 are backdoored, and I've tried hard to look into it. The reason behind the incredible opacity surrounding their progeny appears to be Certicom IPR (at the time), although they did work with Jerry Solinas at the NSA and I do not feel comfortable ruling foul play out completely. The NSA certainly do really use them internally, but I'm not sure what conclusions we can really draw from that.