Take the 2-minute tour ×

This recent new curve mentions something that's new to me: twist security.


Are the existing C25519/Ed25519 curves secure against this form of attack?

share|improve this question

1 Answer 1

up vote 4 down vote accepted


There are several different kinds of twist attacks. Curve25519 is safe against all the ones SafeCurves looks at. Specifically, the cost of a combined attack is $2^{124.3}$, which is considered safe.

share|improve this answer

Your Answer


