Accepting arbitrary EC parameters would, of course, be madness. Not wanting to start a holy war here, this is one case where the NIST curves could be a better c

Accepting arbitrary EC parameters would, of course, be madness. Not wanting to start a holy war here, this is one case where the NIST curves could be a better choice than curve25519 (or any other Montgomery or Edwards curve). Being a Montgomery curve, the order is a multiple of at least 4, and it is possible to try and slip a point of order <= 4 past Alice, which would have the same effect as sending {0,1,-1} in DH. No implementation of curve25519 that I know of checks for low-order input points. NIST curves, being of prime order, have no such pitfall (unless you allow some way of representing the point at infinity in affine coordinates). On the other hand, you can try to slip invalid points past NIST curves, whereas curve25519 and friends are protected against this. PS: I haven't really anything to correct: TLS minutia are not really my area of expertise. It must be some kind of achievement to be lumped together with the likes of 'cperciva, though.