[meithecatte]

The standards claim that the existence of such a (SEED, a, b) tuple is enough to show that there is nothing special about the curve in question. But if one in a billion curves have a special property that only you know about, which would make it easier for you to attack the cryptosystem, you can try a variety of different SEED values until you find a desirable curve.

[acqq]

I don't think we can complain that there were retries over different human-readable seeds to make an appearance of "verifiably at random" design if the chosen human-readable seeds just haven't been published at all.

And if the argument is that the publishing of human-readable seeds was unnecessary because the retries of the procedure could have been performed until some exploit was possible, why even define and publish these definitions? Was it an error? Or something else?