[Cfrg] Curve25519 (and Safecurves more generally)

[Watson Ladd <[e-mail]>]

Paul Lambert has stated that industry doesn't have the guts to take
responsibility for using this in products and would like to blame us
if it goes bad, since they can't blame NIST. (In what other industry
does "we don't stand behind our products, because we don't have the
expertise to determine how good they are" count as acceptable?)

The question to be answered is as follows: is the curve
y^2=x^3+486662x^2+x over the prime field 2^{255}-19 an elliptic curve on
which the DDH is believed to be acceptably hard to provide 128-bit security?

My firm belief is that the answer is yes. There is no known reason why
this curve
could be weak and 486662 is the smallest integer for which this curve
shape is strong.
This curve shape is not particularly special. The only specialness is
the prime, but
that isn't known to do anything.

I would also like to ask this for each curve in Safecurves claimed to
be safe. Note that some numbers in the above question need to be
changed: I leave this as an exercise to the reader.

Is an RFC required to express this opinion? If so I'll write up the
shortest ID on record to define the model of each curve, and provide
the canonical basepoints on each. Would anything more be required for
these curves to count as appropriately blessed?

Lastly, there is a long tradition of providing challenges with
monetary rewards for cracking parameter choices. Bitcoin makes this a
bit redundant, so I will refrain from putting my own money as a prize
for ECC breaking.

Sincerely,
Watson Ladd