Subject: [Cfrg] Random curves

From: Dan Brown <[email-masked]>
Date: Thu, 24 Jul 2014 21:55:51 +0000

‎Just to clarify, I still think random curves can provide better security assurances than special curves, because two real non-generic EC attacks, MOV and SASS, would have been avoided by random curves and because special curves were proposed that were affected by them. 

That said, I agree it's harder to establish the NUMS property for random or pseudorandom curves, and I think rigid special curves‎ are okay, just not the best.

Best regards, 

-- Dan