Schneier on the attack: http://www.wired.com/politics/security/commentary/securityma...
Given the horrible performance of that PRNG, I wonder if anyone implements it, securely I would hope (with random point generation rather than using the "recommended" possibly insecure points).
When you do require a "magic constant" in a cryptographic algorithm, it is common to show good faith by deriving it in a way that would make it difficult to embed a backdoor. For instance ascii text, digits of pi, or the lowest AES encrypted number that fulfils certain criteria.
Edit: these is also called "nothing up my sleeve numbers".
When you do require a "magic constant" in a cryptographic algorithm, it is common to show good faith by deriving it in a way that would make it difficult to embed a backdoor. For instance ascii text, digits of pi, or the lowest AES encrypted number that fulfils certain criteria.
The initialization constant in SipHash is awesome: "somepseudorandomlychosenbytes".