# Ed25519 cryptanalysis and backdoor?

I am looking to implement Ed25519 for decentralized identity at scale.

Has Ed25519 has gone through rigorous cryptanalysis?

Could there be a backdoor in the algorithm?

The algorithm is based on simple* and easy to explain parameters. This is explained here, where various ECC curves are compared and contrasted. Compared to many other common curves, Curve25519 does not use any long, strange, inexplicable parameters like some other curves do. Ed25519, naturally, uses the same curve with the same explainable curve parameters: $$y^2 = x^3 + 486662x^2 + x$$, modulo $$p = 2^{255} - 19$$. These parameters are all justified in the relevant paper introducing the curve. Compare this with, say, the NIST curves which all have very strange, long, and unexplained parameters.