Hurrah! Curves that have a cofactor of 1. (One of the things I didn't like about DJB's speed hacked curve25519…) Since they share the same field as the NIST c

Hurrah! Curves that have a cofactor of 1. (One of the things I didn't like about DJB's speed hacked curve25519…) Since they share the same field as the NIST curves it also means that software won't need any other code for these. I do wish they'd strengthened their verifyably random practices beyond the brainpool technique, instead of just complaining about it. :) For example, they took their non-public nothing up my sleeve choice (C), then hashed it (H(C)) and announced H(C) and this procedure to the world, then put H(C) in a Bitcoin transaction and took M to be the block hash of the block 100 after the block confirming it (because it takes 2^66 sha256 operations to retry a single Bitcoin block if you don't like its outcome, and 100 after ensures that there would be a race with the public network), then picked their random seed as HMAC(M||next-week's NIST random beacon,C) you'd have a random value who's selection someone could only compromise by either inverting H() or controlling the announcing team, and controlling the NIST beacon, and doing 2^66 sha256 * the number of retries on that step (or compromising sha256 to make bitcoin mining trivial).