Comment by ex3ndr

Good Point.RSA security depends mostly on how you build your private keys and ECC security depends on what parameters and what curve was chosen. Russians cryptoexperts doesn't fully trust DJB they found that at the last iteration of picking parameters by DJB for Curve25519 was a bit questionable. Changes was done for "better performance" but no one found what exactly was speeded up. I don't know details, but when curve parameters was tried to be being compromised by NSA was almost always was about adding such "performance optimizations".