### Documentation of save curve criteria for Doppio
Safe Curve criteria checklist:
- [x] The curve must be defined over a prime field F_p
- [x] The conditions on the curve constants for the relevant curve shape must be met
- [x] The cost of a rho attack must be > 2^100
- [x] Let l be the large prime factor of the group order. l must be relatively prime to p, and the embedding degree must be at least (l-1)/100
- [x] The CM discriminant must be > 2^100
- [x] There must be an explanation of how the curve constants were derived
- [x] The curve must admit a Montgomery ladder; this effectively restricts the shape to Montgomery or [twisted] Edwards
- [ ] The security against "combined attacks" on the twist, which is the a generalisation of rho security, must be > 2^100
- [x] The curve must admit a simple complete addition law; this further restricts which Montgomery and Edwards curves are admitted
- [x] The Elligator 2 algorithm for hashing to the curve must work
- [x] There is proven birationality between the Edwards and Montgomery forms of the curve
The factors to document against can be found at https://safecurves.cr.yp.to/