Re:Why Did Satoshi Decide to Use Secp256k1 Instead of Secp25...
by Strilanc on Saturday October 09, 2021 @06:48PM
(#28814046)
They're saying they don't trust that the constants defining the curve were chosen non-maliciously. The NSA has, in the past, standardized protocols that contained intentional backdoors embedded into the constants used in the definition [1]. Because of things like that, it's desirable for cryptographic protocols to use constants chosen in some way that makes backdooring intractable [2].
1: https://en.wikipedia.org/wiki/Dual_EC_DRBG
2: https://en.wikipedia.org/wiki/Nothing-up-my-sleeve_number