Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NIST Elliptic Curves Seeds Bounty

words.filippo.io

Post reply on HN
Print view View original

11–20 of 102 posts

Re: NIST Elliptic Curves Seeds Bounty

#11

Post by worewood »

tptacek wrote: post #3

Some of the backstory here (it's the funniest fucking backstory ever): it's lately been circulating --- though I think this may have been somewhat common knowledge among practitioners, though definitely not to me --- that the "random" seeds for the NIST P-curves, generated in the 1990s by Jerry Solinas at NSA, were simply SHA1 hashes of some variation of the string "Give Jerry a raise". At the time, the "pass a strin…

> At the time, the "pass a string through SHA1" thing was meant to increase confidence in the curve seeds; the idea was that SHA1 would destroy any possible structure in the seed, so NSA couldn't have selected a deliberately weak seed.

It's standard to use transcendental constants like pi or e for this purpose as you can't select them. A phrase could in theory be selected to yield a more desirable hash

Re: NIST Elliptic Curves Seeds Bounty

#13

Post by smegsicle »

tptacek wrote: post #3

Some of the backstory here (it's the funniest fucking backstory ever): it's lately been circulating --- though I think this may have been somewhat common knowledge among practitioners, though definitely not to me --- that the "random" seeds for the NIST P-curves, generated in the 1990s by Jerry Solinas at NSA, were simply SHA1 hashes of some variation of the string "Give Jerry a raise". At the time, the "pass a strin…

a true conspiracist doesn't believe everything he hears

Re: NIST Elliptic Curves Seeds Bounty

#15

Post by foota »

tptacek wrote: post #3

Some of the backstory here (it's the funniest fucking backstory ever): it's lately been circulating --- though I think this may have been somewhat common knowledge among practitioners, though definitely not to me --- that the "random" seeds for the NIST P-curves, generated in the 1990s by Jerry Solinas at NSA, were simply SHA1 hashes of some variation of the string "Give Jerry a raise". At the time, the "pass a strin…

Why doesn't he just do a reverse i search? :)

Re: NIST Elliptic Curves Seeds Bounty

#18

Post by monocasa »

woodruffw wrote: post #6
monocasa wrote: post #4

I mean sha-1 is for sure broken, but I thought that was mainly concerning stuff like collisions via a length extension attack and other known plaintext attacks. Finding what amounts to a passphrase just given a hash was still generally untractable I thought.

Yes, SHA-1 is still considered preimage resistant. But preimage resistance isn't that important here, if the hypothesis about seed structure is correct: SHA-1 is also very fast and trivial to parallelize, and someone dedicated to exploring the permutation space of "Jerry needs a raise" stands a decent chance of discovering the original input.

Except the Jerry needs a raise story has been floating around for a while now. The obvious choices have been mined out.

Re: NIST Elliptic Curves Seeds Bounty

#19

Post by tedunangst »

worewood wrote: post #11
tptacek wrote: post #3

Some of the backstory here (it's the funniest fucking backstory ever): it's lately been circulating --- though I think this may have been somewhat common knowledge among practitioners, though definitely not to me --- that the "random" seeds for the NIST P-curves, generated in the 1990s by Jerry Solinas at NSA, were simply SHA1 hashes of some variation of the string "Give Jerry a raise". At the time, the "pass a strin…

> At the time, the "pass a string through SHA1" thing was meant to increase confidence in the curve seeds; the idea was that SHA1 would destroy any possible structure in the seed, so NSA couldn't have selected a deliberately weak seed. It's standard to use transcendental constants like pi or e for this purpose as you can't select them. A phrase could in theory be selected to yield a more desirable hash

What do you if pi doesn't create a nice curve?

Re: NIST Elliptic Curves Seeds Bounty

#20

Post by some_furry »

tedunangst wrote: post #19
worewood wrote: post #11

Earlier quoted context omitted.

> At the time, the "pass a string through SHA1" thing was meant to increase confidence in the curve seeds; the idea was that SHA1 would destroy any possible structure in the seed, so NSA couldn't have selected a deliberately weak seed. It's standard to use transcendental constants like pi or e for this purpose as you can't select them. A phrase could in theory be selected to yield a more desirable hash

What do you if pi doesn't create a nice curve?

Doesn't pi by definition make a nice curve?

(Dumb geometry joke, sorry. I know what you mean.)

Post reply on HN