No. The claim is that it's about as fast as 22519 but stronger than 448, and might be resistant to some specific attacks. If that's true, that is a good thing.

No. The claim is that it's about as fast as 22519 but stronger than 448, and might be resistant to some specific attacks. If that's true, that is a good thing. But please do not take this as endorsement: I don't think you or anyone else should use this. 448 and 22519 go to great lengths to "nothing-up-my-sleeves" the parameters, and this one just keeps saying "custom designed" parameters. This might be my failing to find it, but it's something I've come to expect in serious crypto papers front-and-centre. It might also be the subject of another paper the author is working on, mere naiveté (on the authors part or mine), or part of a deliberate attempt to infiltrate some other/popular piece of software (like OpenSSL).