Hacker News Reader

You don't have to take Schneier's advice in order to not end up with an elliptic curve random number generator. Nobody does that anyways.

View on HN

Can you elaborate on why?

1 - Very slow

2 - A nightmare to implement securely

3 - Only exists for the sake of provable security

4 - The same standard defines a much better alternative pseudorandom generators based on hashes and/or block ciphers.

Which raises the question of why such a useless thing was even standardized in the first place.

From that perspective, one wonders if they are instead aware of attacks on the other three and designed the fourth to withstand those attacks (but look suspicious and be unappealingly slow).

Overall, the mental game is quite taxing, so I'm going to plead "bureaucracy."

That seems unlikely, DRBGs are really quite solid little things. Or in other words, if the other NIST DRBGs are significantly broken it would almost certainly imply that the hash functions upon which they were built are broken much much worse.

It's easy to see how one could get caught up in a web of paranoid implications, each one less likely to be true than the one before.

I'm curious as well. Why not?

'pbsd gave a much better answer than I could have.

Reply on news.ycombinator.com