[adg001]

Exactly. I attack and repair the Curve25519 backdoor using Elligator in illusoryTLS, a talk delivered at HITB SecConf (and other conferences) based on my entry to the first Underhanded Crypto Contest http://illusoryTLS.com/

Code at https://github.com/secYOUre/rsaelligatorbd