Curve25519 and Curve448 should be strongly favored if you decided to start using ECC. Not unlike RSA, elliptic-curve cryptography has a lot of of edge cases, math pitfalls, and side-channel traps.
* Your implementation produces incorrect results for some rare curve points.
* Your implementation leaks secret data when the input isn't a curve point.
* Your implementation leaks secret data through branch timing.
* Your implementation leaks secret data through cache timing.
Curve25519 and Curve448 are designed with secure implementation in mind, naturally, they trends to have more immunity to pitfalls. There is no invalid curve attack in Curve25519, every random integer is a valid public key, secret-dependent branching can be avoided easily, etc.
https://safecurves.cr.yp.to/
* Your implementation produces incorrect results for some rare curve points.
* Your implementation leaks secret data when the input isn't a curve point.
* Your implementation leaks secret data through branch timing.
* Your implementation leaks secret data through cache timing.
Curve25519 and Curve448 are designed with secure implementation in mind, naturally, they trends to have more immunity to pitfalls. There is no invalid curve attack in Curve25519, every random integer is a valid public key, secret-dependent branching can be avoided easily, etc.
https://safecurves.cr.yp.to/