david wong


Nothing up my sleeve numbers posted February 2015

Why does the round constants in sha1 have those specific values?


Kt is the round constant of round t;

from SH1-1 - Wikipedia:


from Nothing up my sleeve number:




It's not always sufficient to pick a nothing up my sleeve numbers.
Those constants never raised serious concern for the symmetric crypto primitives because in this cas, introducing a trap seems extremely hard ... but it's not anymore the case for asymmetric crypto ... think of the infamous Dual-EC-DRBG.


Maxime: in the case of Dual EC, the two values P and Q are not NUMP values


David : You are perfectly right ! But what I mean is, you have to be very careful with the use of NUMP in asymmetric crypto.

Keep going with your blog .... I like reading your post !


Ah yeah sorry, you mean it's easy to find values that creates a backdoor _and_ are generated as NUMS? I should really read that badass paper :)