Isn&#x27;t this circular reasoning? If you do that, you have another constant to justify: the offset into pi you used. Go find BADA55 in Pi, and relay back to us what the offset is.†<p>You don&#x27;t need lotteries to break this logjam. You just demand the minimal parameters that satisfy the security a&#x2F;o performance considerations for your problem. LaMacchia and Costello did this for NUMS without even needing recourse to constants: they just start with the target security level, find the minimal prime for that security level, and then the minimal suitable (given, for instance, SafeCurves) d for an Edwards curve.<p>† <i>My friend Peter found it: <a href="http:&#x2F;&#x2F;pi.nersc.gov&#x2F;cgi-bin&#x2F;pi.cgi?word=BADA55&amp;format=hex" rel="nofollow">http:&#x2F;&#x2F;pi.nersc.gov&#x2F;cgi-bin&#x2F;pi.cgi?word=BADA55&amp;format=hex</a> --- so: justify the</i> binary <i>offset &quot;2733181964&quot;. :)</i>