That's a good example of how a "SafeCurve" caused a vulnerability that wouldn't exist in Weierstrass curve.
But many smart people made many such mistakes in the past. If we gatekeep it to much then we won't have anyone left to implement crypto.
But many smart people made many such mistakes in the past. If we gatekeep it to much then we won't have anyone left to implement crypto.
I said if one isn't comfortable with the math, maybe don't try to roll one's own crypto and advertise or use it as production-grade crypto.
Crypto is deep. You can get involved at the levels you feel comfortable with.
First, some Maverick is going to ignore what everyone says and implement crypto for serious applications. Like yours truly.
Second, I've seen it go a bit too far when I implemented Argon2i: there was a discrepancy between the specs and the reference implementations, and the authors haven't corrected the specs. I figured this was because not enough independent implementers bugged them about that. (Now, 3 years later, the specs still aren't fixed, so maybe the authors are really really busy. At least but the issue is still open: https://github.com/P-H-C/phc-winner-argon2/issues/183 )