[curves] More small curves

[Robert Ransom]

Modulo 2^198 - 17, the Edwards curve with a=-1, d=19 is secure, and
the Edwards curve with a=-1, d=4871 is twist-secure.  (already posted
on the messaging list)

Modulo 2^213 - 3, the Edwards curve with a=-1, d=12523 is twist-secure.


Modulo 2^194 - 33 (not as nice, but it's minimal-length for a 192-bit
group on an Edwards curve):

a=-1, d=-120 is minimal with a secure group;
a=-1, d=204 is also secure;
a=-1, d=229 is minimal with a secure group such that the isogenous
curve a=1, d=230 has non-square d;

a=-1, d=20764 is twist-secure.


Again, don't use these unless your key size is seriously constrained.


Robert Ransom