[Cfrg] NUMs/rigidity security (Re: [CFRG] Safecurves v Brainpool / Rigid v Pseudorandom)

[Adam Back <[e-mail]>]

You know in principle we ought to stick to something with low entropy for
the NUMs/rigidity seed.  I commented previously for example that someone can
do a fair bit of grinding by building a catalog of headlines, quote
dictionaries, and permuting their punctuation, white space etc.  Also
permuting arbitrary implementation choices (encoding, endianness, equally
plausible rigid choices, etc) So possibly the digits of pi are more
convincing than some obscure literary quote or a headline.  The point is to
start from an ungrindable starting point, with canonicalized choices at each
step.  I think so far the NUMS argument is probably gamable to a non-trivial
extent due to the above effects.

ie for secure NUMs you actually need to canonically encode all fo the
arbitrary choices in a standardized language, sort them, and select the
arbitrary choices at all levels, using the deterministic PRNG seed off pi. 
And even the PRNG design itself needs to be standardized, otherwise its
design variants also admit yet more bits.

The NUMs argument is good but so far is probably itself gameble, we need a
NUMs standard to remove as many of those variabilities as possible.

Adam

ps people might want to trim the quoted text in places, I almost missed some
comments they were that many pages down of recursive unedited quoting!