NIST Elliptic Curves Seeds Bounty
words.filippo.io
NIST Elliptic Curves Seeds Bounty
1–10 of 102 posts
Re: NIST Elliptic Curves Seeds Bounty
#2I'm one of the people contributing to the bounty because if it really is a password-crackable phrase, it would be of significant historical impact to know.
Re: NIST Elliptic Curves Seeds Bounty
#3Some of the backstory here (it's the funniest fucking backstory ever): it's lately been circulating --- though I think this may have been somewhat common knowledge among practitioners, though definitely not to me --- that the "random" seeds for the NIST P-curves, generated in the 1990s by Jerry Solinas at NSA, were simply SHA1 hashes of some variation of the string "Give Jerry a raise".
At the time, the "pass a string through SHA1" thing was meant to increase confidence in the curve seeds; the idea was that SHA1 would destroy any possible structure in the seed, so NSA couldn't have selected a deliberately weak seed. Of course, NIST/NSA then set about destroying its reputation in the 2000's, and this explanation wasn't nearly enough to quell conspiracy theories.
But when Jerry Solinas went back to reconstruct the seeds, so NIST could demonstrate that the seeds really were benign, he found that he'd forgotten the string he used!
If you're a true conspiracist, you're certain nobody is going to find a string that generates any of these seeds. On the flip side, if anyone does find them, that'll be a pretty devastating blow to the theory that the NIST P-curves were maliciously generated --- even for people totally unfamiliar with basic curve math.
So: pretty fun bounty.
Re: NIST Elliptic Curves Seeds Bounty
#4I mean sha-1 is for sure broken, but I thought that was mainly concerning stuff like collisions via a length extension attack and other known plaintext attacks.
Finding what amounts to a passphrase just given a hash was still generally untractable I thought.
Re: NIST Elliptic Curves Seeds Bounty
#5I mean sha-1 is for sure broken, but I thought that was mainly concerning stuff like collisions via a length extension attack and other known plaintext attacks. Finding what amounts to a passphrase just given a hash was still generally untractable I thought.
It's a simple dictionary attack, which is how most password hashes are broken. This has really nothing to do with SHA1 itself.
Re: NIST Elliptic Curves Seeds Bounty
#6I mean sha-1 is for sure broken, but I thought that was mainly concerning stuff like collisions via a length extension attack and other known plaintext attacks. Finding what amounts to a passphrase just given a hash was still generally untractable I thought.
Yes, SHA-1 is still considered preimage resistant. But preimage resistance isn't that important here, if the hypothesis about seed structure is correct: SHA-1 is also very fast and trivial to parallelize, and someone dedicated to exploring the permutation space of "Jerry needs a raise" stands a decent chance of discovering the original input.
Re: NIST Elliptic Curves Seeds Bounty
#7Now, for the real question:
Did Jerry get a raise?
Re: NIST Elliptic Curves Seeds Bounty
#8Some of the backstory here (it's the funniest fucking backstory ever): it's lately been circulating --- though I think this may have been somewhat common knowledge among practitioners, though definitely not to me --- that the "random" seeds for the NIST P-curves, generated in the 1990s by Jerry Solinas at NSA, were simply SHA1 hashes of some variation of the string "Give Jerry a raise". At the time, the "pass a strin…
By the late nineties using both MD5 and SHA1 for "additional robustness" together in ad-hoc constructions was also en vogue. SSLv2 and SSLv3 are good examples. The outputs match the size of a SHA1, but it wouldn't be that shocking if the pipeline were some form of echo "$string" | md5sum | sha1sum.
Re: NIST Elliptic Curves Seeds Bounty
#9Now, for the real question: Did Jerry get a raise?
They're still in seed stage
Re: NIST Elliptic Curves Seeds Bounty
#10[deleted]