Say NSA knows about a weakness --- perhaps something that requires an additional parameter check when receiving a point on a curve --- that comes up in only 1 out of every 1,000,000 generated curves of a particular form.<p>The worry is that NSA could come up with a set of possible &quot;first principles&quot; mathematical constants and search through 1,000,000 permutations of those constants to find that 1 weak curve. Then they&#x27;d write a standard suggesting that the permutation they chose follows naturally from mathematics, and their starting point was selected to be transparent and to guarantee that they hadn&#x27;t manipulated the standard to weaken it. Obviously, they&#x27;ve done the very opposite thing, but the point of BADA55 is that you can manipulate standards surreptitiously this way.<p>The point isn&#x27;t that it&#x27;s possible to find weak curves. Of course it is possible to do that.