Hacker News Reader

With a tiny number of exceptions, Bitcoin private keys are just random sequences of 256 bits. They don't involve primality. So unless a shared CRNG is truly awful, there shouldn't be any reason why keys would cluster around certain values.

View on HN

Which is basically the thesis of the underlying "Ron Was Wrong Whit Was Right" paper --- that discrete log systems are safer than RSA. Since then, there's been more work done on the pitfalls of prime generation, perhaps most notably the "Prime And Prejudice" paper, which is really excellent and more interesting technically than this article:

https://eprint.iacr.org/2018/749.pdf

New systems should generally avoid RSA, for this reason among several others.

Isn't the point of "Prime and Prejudice" that primality tests that are perfectly adequate for RSA key generation are inadequate to verify the primality of adversarial inputs, in protocols like negotiated DHE or whatnot?

Dammit. I just wanted a cool link to Prime and Prejudice!

You're right, of course.

> generally avoid RSA, for this reason among several others.

What are the others?

Reply on news.ycombinator.com