It's a perfectly fine set of criteria for best practices in defining modern elliptic curves, imho. Focus is on the simplicity of correct implementations, and o

It's a perfectly fine set of criteria for best practices in defining modern elliptic curves, imho. Focus is on the simplicity of correct implementations, and on trying to avoid manipulatable variables. However, I do not on balance think the NIST curves secp256r1 and secp384r1 are backdoored, and I've tried hard to look into it. The reason behind the incredible opacity surrounding their progeny appears to be Certicom IPR (at the time), although they did work with Jerry Solinas at the NSA and I do not feel comfortable ruling foul play out completely. The NSA certainly do really use them internally, but I'm not sure what conclusions we can really draw from that.