This paper analyzes the cost of breaking ECC under the following assumptions: 1 ECC is using a standardized elliptic curve that was actually chosen by an attacker; 2 the attacker is aware of a vulnerability in some curves that are not publicly known to be vulnerable.#R##N##R##N#This cost includes the cost of exploiting the vulnerability, but also the initial cost of computing a curve suitable for sabotaging the standard. This initial cost depends heavily upon the acceptability criteria used by the public to decide whether to allow a curve as a standard, and in most cases also upon the chance of a curve being vulnerable.#R##N##R##N#This paper shows the importance of accurately modeling the actual acceptability criteria: i.e., figuring out what the public can be fooled into accepting. For example, this paper shows that plausible models of the "Brainpool acceptability criteria" allow the attacker to target a one-in-a-million vulnerability and that plausible models of the "Microsoft NUMS criteria" allow the attacker to target a one-in-a-hundred-thousand vulnerability.
['Daniel J. Bernstein', 'Tung Chou', 'Chitchanok Chuengsatiansup', 'Andreas Hülsing', 'Eran Lambooij', 'Tanja Lange', 'Ruben Niederhagen', 'Christine van Vredendaal']
How to Manipulate Curve Standards: A White Paper for the Black Hat http://bada55.cr.yp.to