I&#x27;m pretty sure the authors aren&#x27;t suggesting that Curve25519 has been tampered with, because the FAQ for this paper suggests (a) that they continue to recommend Curve25519, and (b) that they are proposing this curve because they&#x27;re concerned that there aren&#x27;t any good alternatives to Curve25519 with trustworthy seeds.<p>Curve25519 follows roughly the same generation procedure as Microsoft&#x27;s NUMS: it uses minimal parameters that satisfy a performance&#x2F;security goal. NUMS starts from a security level, selects the smallest prime that satisfies that level, and then selects the smallest Edwards &#x27;d&#x27; that passes security criteria. Curve25519 selects a prime of sufficient security as close as possible to a power of 2 (making it sparse and thus fast to do math on in software), and then selects a minimal Montgomery A given security criteria.<p>$1MM and 25519 represent two different schools of thought about how to generate curves. $1MM says, generate random unstructured parameters, and come up with a randomness procedure that is difficult to impeach. 25519 says generate minimal parameters that achieve particular performance goals. Both schools of thought address the concern that the curve generation procedure might be untrustworthy, but in different ways: the former by somehow proving randomness, the latter by removing degrees of freedom.<p>25519&#x27;s school of thought has pretty much won the Internet.