Re: [Cfrg] 512-bit twisted Edwards curve and curve generation methods in Russian standardization

[Paul Hoffman <[e-mail]>]

On Jan 28, 2015, at 9:22 AM, Tony Arcieri <[e-mail]> wrote:
> Dan Bernstein and Tanja Lange have already demonstrated that such "verifiably random" generation procedures can be used to surreptitiously tweak specific curve parameters:
> 
> http://safecurves.cr.yp.to/bada55.html

That is a huge overstatement of what they showed. They showed that if a group of people with a common interest pick the form for the verifiably random value, they can tweak parameters. There are obvious procedures that prevent the number being chosen by such a group, and instead have the number chosen by a group where even if a single person is trusted, the randomness is trusted.

> I for one would not feel particularly inclined to trust a curve generated with this method, and would personally prefer the sort of rigid curve generation approach that this committee and others have been working on to any curve with large unexplained mystery constants.

If there were no downside to using a trustable random number, we could use one, but it seems that there are performance penalties and difficulty to make such calculations constant-time (if I understand earlier arguments correctly).

--Paul Hoffman