> that Ed25519 is birational to Curve25519, not actually isomorphic That might be the case, I only meant isomorphic in the programming sense of f(x) = h⁻¹(g(h(

> that Ed25519 is birational to Curve25519, not actually isomorphic That might be the case, I only meant isomorphic in the programming sense of f(x) = h⁻¹(g(h(x))) for relatively trivial h. > I thought Ed25519 was [...] slower for variable-base operations in ECDH. My understanding is that Ed25519 requires replacing several of Curve25519's field squarings with general multiplications, but isn't actually any slower if you use a general multiply for everything. I'm not sure how much optimization you can get out of squaring though, so it might be a easy 10% bonus you're passing up there.