Re: [Cfrg] 512-bit twisted Edwards curve and curve generation methods in Russian standardization

[CodesInChaos <[e-mail]>]

On Thu, Jan 29, 2015 at 9:08 AM, Stanislav V. Smyshlyaev
<[e-mail]> wrote:
> by a group of experts where the condition mentioned by Paul ("a
> group where even if a single person is trusted") is satisfied

How did the generation process work?

When just hashing together input from trusted and untrusted sources,
the last source to pick their value can run a brute-force search, to
manipulate the output. Depending on the time and money restrictions on
that attacker, it should be possible to execute such an attack even if
weak curves were significantly rarer than 2^{18}. I'd guess somewhere
around 2^{-40} to 2^{-60} is in range for a powerful attacker.

If generation was done using a commitment followed by revealing the
inputs only after all participants commited, then this is indeed
random as long as at least one participant is honest.