The thesis of this paper seems to be that there aren&#x27;t many alternatives to 25519. But anybody who watched the fiasco of the IRTF trying to standardize a recommendation on 25519 knows that&#x27;s not true. Browser vendors were sold on DJB&#x27;s curve and asked IETF to add it to TLS; given that simple charter, people came out of the freaking woodwork with alternatives.<p>The &quot;randomness derived from lotteries&quot; property seems like a gimmick. Generating plausible random seeds isn&#x27;t the hard problem with generating new curves. Rather, the problem is coming up with curves that are performant on common hardware without any patent-encumbered techniques.<p>It&#x27;s also not clear to me how the $1MM curve is a meaningful alternative to 25519. Almost the entire paper is given to considering how to generate random parameters. Having accomplished that task, the paper simply generates a random Edwards curve, using their lottery generator to find a random prime, d, and base point, filtered against the SafeCurve requirements. So they end up with (in effect) a randomized version of Bernstein&#x27;s curve. If 25519 somehow falls, why wouldn&#x27;t this curve fall with it?<p>Compare this paper to those of 25519:<p><a href="https:&#x2F;&#x2F;cr.yp.to&#x2F;ecdh&#x2F;curve25519-20060209.pdf" rel="nofollow">https:&#x2F;&#x2F;cr.yp.to&#x2F;ecdh&#x2F;curve25519-20060209.pdf</a><p>... or to FourQ:<p><a href="https:&#x2F;&#x2F;eprint.iacr.org&#x2F;2015&#x2F;565.pdf" rel="nofollow">https:&#x2F;&#x2F;eprint.iacr.org&#x2F;2015&#x2F;565.pdf</a><p>Also: the swipe at Brainpool seems disingenuous. Zero is the number of people who believe that Brainpool&#x27;s mathematical constants were arranged specifically to create a backdoor. The point of BADA55 is that Brainpool&#x27;s use of mathematical constants as seeds isn&#x27;t dispositive, and that the performance-targeting parameters of 25519 are equally credible.