It doesn't mention it because this is from 2012 (http://eprint.iacr.org/2012/251 http://eprint.iacr.org/2012/251) and the paper you mentioned is from 2013. (htt

It doesn't mention it because this is from 2012 (http://eprint.iacr.org/2012/251 http://eprint.iacr.org/2012/251) and the paper you mentioned is from 2013. (http://eprint.iacr.org/2013/338 http://eprint.iacr.org/2013/338) Here's a comment from DJB regarding the 2013 paper: https://twitter.com/hashbreaker/status/342320351776231425 https://twitter.com/hashbreaker/status/342320351776231425 > http://eprint.iacr.org/2013/338 http://eprint.iacr.org/2013/338 advertises "provable security" while sacrificing actual security. Don't use it.