The use of ECDH is controversial to some because of the fear of backdoors that could be utilized by choosing curves with certain parameters. This lead to the rejection of the NIST curves. Now my question is, is the planting of backdoors also possible with classic DH by choosing certain parameters for p and g?
1
-
$\begingroup$ See summary at crypto.stackexchange.com/questions/25027/… and example in crypto.stackexchange.com/questions/27623/… $\endgroup$– dave_thompson_085Commented yesterday
Add a comment
|