Excellent points all around, and thank you for the pointer to the ECC slides :)
(And indeed, nature could have been kinder to us and given us a Mersenne between 127 and 521...)
Re:PuTTY vulnerability vuln-p521-bias
by GoblinSlayer on Tuesday April 16, 2024 @05:19AM
(#40049937)
Shouldn't there be another close enough prime? Like 2^510-1 or 2^511-19?
EdDSA, which is essentially deterministic Schnorr, does solve the problem.
Also, the use of P-521 didn't specifically cause the vulnerability, but the bad interaction between SHA512 and P-521 did play a role. It is unfortunate that nature conspired against us to make 2^511 - 1 a composite number. The fact that you have to go up to 521 bits to get a Mersenne prime whereas the natural target length for a hash output is 512 bits is the fatal interaction here.