Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
Bruce Schneier and Gregory Maxwell have both stated that they believe the constants chosen for NIST's P curves (i.e. P-256r) are cooked. DJB has put together a detailed list of red flags but, outside of the suspicious constant, everything else appears to be potential implementation issues.
What kind of a speedup could they gain from cooking the constant?
Note: I'm aware of related questions, I'm looking for more of a high-level takeaway.
These are "red flags". No one knows of a specific exploit, only some possible reasons to be concerned that one might exist. Since no one knows of a specific attack, we can't possibly know how much speedup such a hypothetical attack might allow. Basically, you're asking for speculation where there is not enough information to allow meaningful speculation, so there's no useful answer to your question. Of course, if the curves are cooked, the sky is the limit: it could be arbitrarily bad. So at this point, there's not a lot of hard data to make a risk management decision.
Well, what I concluded from DJB is that the chosen elliptic curves are not as hard as discrete logarithm is + curve 256 lack some security porosities in addition the developer needs to implement extra controls and countermeasures to proof the correctness of the elliptic curve parameters (especially in side channel & fault attacks).
Check out DJB and Tanja talk in ECCHack at https://www.youtube.com/watch?v=l6jTFxQaUJA
