I think DJB is saying that the "default" ones recommended by NIST like P-224 are weak, but if you use something like Curve25519, then you're fine. Full paper:

I think DJB is saying that the "default" ones recommended by NIST like P-224 are weak, but if you use something like Curve25519, then you're fine. Full paper: http://cr.yp.to/talks/2013.05.31/slides-dan+tanja-20130531-4x3.pdf http://cr.yp.to/talks/2013.05.31/slides-dan+tanja-20130531-4...