That's true, but if the curve uses a well-studied underlying field where the curves that are vulnerable to cryptanalytic attacks can be avoided (prime fields le

That's true, but if the curve uses a well-studied underlying field where the curves that are vulnerable to cryptanalytic attacks can be avoided (prime fields lead the way here, last time I worked on an ECC implementation ~ 5 years ago), the risk from this threat isn't so great -I'd worry about other aspects of the resulting system first. A quick google search shows DJB and Tanja Lange have some nice analysis of existing curves here: http://safecurves.cr.yp.to/index.html http://safecurves.cr.yp.to/index.html Of course, if the cryptographers generating the curve aren't sharing their knowledge of some new class of weak curves, all bets are off.