Why is there the option to use NIST P-256 in gnupg? I am surely not an expert on the field , but I heared some people say that NIST P-256 is somehow backdoored .

I don't know about the seriousness of this claim . Maybes it is just some conspiracry theory . But if there is some truth about it , then why is it still implemented ? Almost everyone I asked saied it is a bad idea to use P-256 . If true :


Why is it still in GPG ( as of 2017 ) .
Does it have any use ( expect legacy &amp; compartibility ) ?
Is it really broken to the point where it is unsafe to use ( in a professional environment )
Because P-256 is the most used elliptic curve and there are no certain reasons to believe it's insecure.
It's the first standardized curve at the 128 bit security level (which is very popular).

The rumors about its backdoor came from 3 factors:


The Snowden's revelations included a generic claim of the NSA trying to backdoor NIST standardized crypto
DualEC DRBG being a NIST standard actually backdoored by the NSA
Daniel J. Bernstein trying to push for his own curve25519


But there is no backdoor connection between DuelEC DRBG and NIST Curves and we have no idea about how to backdoor an elliptic curve. Bernstein and Lange built a site claiming P-256 is not safe. But it actually boils down to the fact that NIST curves, generated in the 90s, lack some of the fancy features of more modern elliptic curves, as the fancy techniques were not known at the time.

To address your questions directly:


For compatibility reasons, since it's the most used elliptic curve.
Yes of course, e.g. TLS.
No, we believe it's secure.