<html><head><style>body{font-family:Helvetica,Arial;font-size:13px}</style></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;"><a href="https://www.ietf.org/mail-archive/web/cfrg/current/msg05619.html">https://www.ietf.org/mail-archive/web/cfrg/current/msg05619.html</a></div> <br> <div id="bloop_sign_1459539572070129920" class="bloop_sign"><div style="font-family:helvetica,arial;font-size:13px">-- <br>Thomas Ptacek<br>312-231-7805</div></div> <br><p class="airmail_on">On April 1, 2016 at 12:37:30 PM, Ron Garret (<a href="mailto:ron@flownet.com">ron@flownet.com</a>) wrote:</p> <blockquote type="cite" class="clean_bq"><span><div><div></div><div>One of the motivations for using curve25519 is supposedly its transparency in terms of not having any weird parameters of unknown provenance that could conceal weaknesses. But there is one weird number in the curve25519 spec, the coefficient of x^2, which is 486662. That number seems to have been pulled out of a hat. The only condition on it is that A^2-4 is not a square in 2^255-19. But 486662 is far from the smallest number that meets that conditions. That would be (AFAICT) 5. So why 486662?
<br>
<br>rg
<br>
<br>_______________________________________________
<br>Curves mailing list
<br>Curves@moderncrypto.org
<br>https://moderncrypto.org/mailman/listinfo/curves
<br></div></div></span></blockquote></body></html>