[jrochkind1]

The NSA also has a mission-based interest in _breaking_ other people's crypto though, which is generally known.

Which is generally known, so I'm surprised by your argument. Even if the NSA knows more than they are telling us, this doesn't result in most of us feeling less worried, as their ends may not be strengthening the public's cryptography!

[aaomidi]

Yes: https://en.wikipedia.org/wiki/Dual_EC_DRBG

Also, we still to this day do not know where the seed for P256 and P384 came from. And we're using that everywhere. There is a non-zero chance that the NSA basically has a backdoor for all NIST ECC curves, and no one actually seems to care.

[sweis]

NIST P-256 curve seed came from the X9.62 specification drafted in 1997. It was provided by an NSA employee, Jerry Solinas, as an example seed among many other seeds, including those provided by Certicom. Read this for more details: https://eprint.iacr.org/2015/1018

[brohee]

Or you find it somewhat credible but still use them because fending off the NSA is not something you want to spend energy on, and you are confident in the fact that NSA think no one else can find the backdoor.

[cosmojg]

Isn't that what the person you're replying to said?

[jrochkind1]

It's clear to me now that it is! Either I misread it, or maybe they edited it to make it more clear!

[garba_dlm]

I just find it sad that it's things like these that make it impossible for the layman to figure out what is going on with, for example, Mochizuki's new stuff

I have no reason to doubt that a lot of math has been made more difficult than necessary just because it is known to give a subtle military advantage in some cases, but this isn't new;