&quot;Curve25519 was designed to be as fast as possible, with no security compromise. This is both a strength and a potential weakness:<p><pre><code>    a strength because it gives a valid argument that no trapdoor was introduced in the design,
    a potential weakness because Curve25519 uses a very specific prime field. As of now, no attack exploiting this specificity is known.
</code></pre>
For applications where speed is paramount, Curve25519 is probably the best option. But for most applications, where losing a little on the efficiency side is &quot;not a big deal&quot;, Million Dollar Curve is probably the safest choice.&quot;<p>Sorry, no.  Many more eyeballs have been on Curve25519 and DJB reputation, both of which gives me _more_ confidence in that than <i>any</i> new alternative.<p>Secondly, the <i>implementation</i> is as important as the design.  Again, Curve25519 have vetted implementations, something which takes time.<p>Finally, the notion that speed is a liability is ludicrous.  The <i>lack</i> of speed is a major liability.<p>Move along, nothing to see here.