NIST Elliptic Curves Seeds Bounty
Some of the backstory here (it&#x27;s the funniest fucking backstory ever): it&#x27;s lately been circulating --- though I think this may have been somewhat common knowledge among practitioners, though definitely not to me --- that the &quot;random&quot; seeds for the NIST P-curves, generated in the 1990s by Jerry Solinas at NSA, were simply SHA1 hashes of some variation of the string &quot;Give Jerry a raise&quot;.<p>At the time, the &quot;pass a string through SHA1&quot; thing was meant to <i>increase</i> confidence in the curve seeds; the idea was that SHA1 would destroy any possible structure in the seed, so NSA couldn&#x27;t have selected a deliberately weak seed. Of course, NIST&#x2F;NSA then set about destroying its reputation in the 2000&#x27;s, and this explanation wasn&#x27;t nearly enough to quell conspiracy theories.<p>But when Jerry Solinas went back to reconstruct the seeds, so NIST could demonstrate that the seeds really were benign, he found that he&#x27;d forgotten the string he used!<p>If you&#x27;re a true conspiracist, you&#x27;re certain nobody is going to find a string that generates any of these seeds. On the flip side, if anyone does find them, that&#x27;ll be a pretty devastating blow to the theory that the NIST P-curves were maliciously generated --- even for people totally unfamiliar with basic curve math.<p>So: pretty fun bounty.