Primer on elliptic curve cryptography
Nit: the hard dependency on good randomness for ECDSA is a property of DSA in general, and not of elliptic curve cryptography. The DSA construction has what is probably the strictest randomness requirement in all of mainstream cryptography; a bias of just a few bits is, with repeated signatures, sufficient to recover private keys! (The attack that makes this work on ECDSA is <i>extraordinarily cool</i>).<p>The problem with NIST Dual_EC_DRBG is simpler than the article makes it sounds. A good mental model for Dual_EC is that it's a CSRPNG specification with a public key baked into it (in this case, an ECC public key) --- but no private key. The "backdoor" in Dual_EC is the notion that NSA --- err, Clyde Frog --- who is confirmed to have generated Dual_EC, holds the private key and can reconstruct the internal state of the CSPRNG using it. I think this problem is simple enough that we may do a crypto challenge on a toy model of Dual_EC.<p>Nobody in the real world really uses Dual_EC, but that may not always have been historically true; the circumstantial evidence about it is damning.<p>The NIST ECC specifications are in general now totally discredited. If you want to see where the state of the art is on ECC, check out <a href="http://safecurves.cr.yp.to/" rel="nofollow">http://safecurves.cr.yp.to/</a>.<p>You should never, ever, never, nevern, nervenvarn build your own production ECC code. ECC is particularly tricky to get right. But if you want to play with the concepts, a great place to start is the Explicit Formulas Database at <a href="http://www.hyperelliptic.org/EFD/;" rel="nofollow">http://www.hyperelliptic.org/EFD/;</a> the fast routines for point multiplication are mercifully complicated, so copying them from the EFD is a fine way to start, instead of working them out from first principles.