Now, for the real question: Did Jerry get a raise?
He got a rise out of the conspiracy people
NIST Elliptic Curves Seeds Bounty
41–50 of 102 posts
Re: NIST Elliptic Curves Seeds Bounty
#42Has Jerry ever got the raise? (:
No but you might get a $12k bonus
Re: NIST Elliptic Curves Seeds Bounty
#43Some of the backstory here (it's the funniest fucking backstory ever): it's lately been circulating --- though I think this may have been somewhat common knowledge among practitioners, though definitely not to me --- that the "random" seeds for the NIST P-curves, generated in the 1990s by Jerry Solinas at NSA, were simply SHA1 hashes of some variation of the string "Give Jerry a raise". At the time, the "pass a strin…
> Some of the backstory here (it's the funniest fucking backstory ever): it's lately been circulating --- though I think this may have been somewhat common knowledge among practitioners, though definitely not to me --- that the "random" seeds for the NIST P-curves, generated in the 1990s by Jerry Solinas at NSA, were simply SHA1 hashes of some variation of the string "Give Jerry a raise". For a longer history see the…
Its funny - all this doubt and suspicion of the NSA but then you end your post about how NSA has been saving our asses. Maybe they aren't so bad afterall? /s
Re: NIST Elliptic Curves Seeds Bounty
#44Some of the backstory here (it's the funniest fucking backstory ever): it's lately been circulating --- though I think this may have been somewhat common knowledge among practitioners, though definitely not to me --- that the "random" seeds for the NIST P-curves, generated in the 1990s by Jerry Solinas at NSA, were simply SHA1 hashes of some variation of the string "Give Jerry a raise". At the time, the "pass a strin…
A conspiracy theorist can always find excuses to wave away evidence incompatible with their beliefs
Re: NIST Elliptic Curves Seeds Bounty
#45Earlier quoted context omitted.
You come up with a hopefully simple rule to try again. Like skip the first byte and try again. Assuming that you publish your definition of "a nice curve" then third parties can verify that you used the first offset in pi that worked.
You could however test different schemes like this prior to announcing the scheme.
There's only so much room for simple methods.
So maybe you get to pick the most crackable for you out of 25 options. But you can't hide a proper backdoor like that.
Re: NIST Elliptic Curves Seeds Bounty
#46Earlier quoted context omitted.
> if anyone does find them, that'll be a pretty devastating blow to the theory that the NIST P-curves were maliciously generated IDK, if I don't think that finding that a seed matches a hash of "Give Jerry a raise of $100000 dollars now!!!" is any evidence for that, because if I had a desire to generate malicious constants, and knew some unusual property that they must have to be weak, then nothing would prevent me f…
At the point where we find an intelligible English string that generates the NIST P-curve seeds, nobody serious is going to take the seed provenance concerns seriously anymore. I think everybody sort of understands that people who don't work in cryptography are always going to have further layers of theory to add, the same way people waiting for the "Mother of All Short Squeezes" do with Direct Share Registration and…
This would basically be a Nostradamus attack. If we're going around claiming exciting (read: improbable) things about P256 I don't know what stops us from claiming the NSA can generate collisions in the hash functions it also chose the parameters for.
Re: NIST Elliptic Curves Seeds Bounty
#47Some of the backstory here (it's the funniest fucking backstory ever): it's lately been circulating --- though I think this may have been somewhat common knowledge among practitioners, though definitely not to me --- that the "random" seeds for the NIST P-curves, generated in the 1990s by Jerry Solinas at NSA, were simply SHA1 hashes of some variation of the string "Give Jerry a raise". At the time, the "pass a strin…
I hope it's something like SHA1("Bill Clinton is a poopy head.")
Re: NIST Elliptic Curves Seeds Bounty
#48Re: NIST Elliptic Curves Seeds Bounty
#49If you're feeling lucky, you can give it a shot by guessing the sha1 hash here: https://wending.dev/hash_guessing/
Re: NIST Elliptic Curves Seeds Bounty
#50Some of the backstory here (it's the funniest fucking backstory ever): it's lately been circulating --- though I think this may have been somewhat common knowledge among practitioners, though definitely not to me --- that the "random" seeds for the NIST P-curves, generated in the 1990s by Jerry Solinas at NSA, were simply SHA1 hashes of some variation of the string "Give Jerry a raise". At the time, the "pass a strin…
> At the time, the "pass a string through SHA1" thing was meant to increase confidence in the curve seeds; the idea was that SHA1 would destroy any possible structure in the seed, so NSA couldn't have selected a deliberately weak seed. It's standard to use transcendental constants like pi or e for this purpose as you can't select them. A phrase could in theory be selected to yield a more desirable hash
> It's standard to use transcendental constants like pi or e for this purpose as you can't select them.
If one may choose between one or the other without arousing suspicion, that's one bit of entropy.
If I can add the possibility of sin(1) and cos(1), that's two bits.
And remind me: are we using sha1, or md5? Or perhaps sha1 -> md5, or md5 -> sha1?
And so on, until I have enough bits to reimplement the suspicious seed in the cracks of all these innocuous, and very poorly specified "standard" choices.
Dan Bernstein (and some other cryptographer?) wrote about this and did a demo creating over a million curves in a short/practical amount of time on commodity hardware. All of them had seeds specified using a "standard" method like what you mention above.
It makes me think all cryptographers ought to just go ahead and choose suspicious seeds where prudent, kinda like if you're going to play the lottery, just go ahead and choose the numbers 1 2 3 4 5 etc. At least then you get instant, free information about the lack of knowledge of the people who complain that you're doing it wrong.