Re: [Cfrg] 512-bit twisted Edwards curve and curve generation methods in Russian standardization

[Tony Arcieri <[e-mail]>]

On Wed, Jan 28, 2015 at 6:14 AM, Stanislav V. Smyshlyaev <[e-mail]>
wrote:

> As we believe (and as it has been mentioned earlier during discussion at
> CFRG), the initital seed value doesn't have to be chosen explicitly in case
> of trust in basic hash function properties – to gain some "backdoor-type"
> properties of the curve with d = hash(W), one has either to combine such
> algebraic properties of a curve with properties of a hash function (for a
> trivial example, to have an ability to obtain a hash preimage) or to choose
> a very probable "backdoor-type" property of a curve (such that it is
> possible to obtain by random choice of a curve).
>

Hi Stanislav,

Dan Bernstein and Tanja Lange have already demonstrated that such
"verifiably random" generation procedures can be used to surreptitiously
tweak specific curve parameters:

http://safecurves.cr.yp.to/bada55.html

I for one would not feel particularly inclined to trust a curve generated
with this method, and would personally prefer the sort of rigid curve
generation approach that this committee and others have been working on to
any curve with large unexplained mystery constants.

-- 
Tony Arcieri