Is Curve25519 vulnerable to private key exposure in the case of a bad RNG? I'm really excited by what I've learned of advancements in elliptic-curve cryptography. Curve25519 seems to be a great choice at this point in time, but if I recall correctly, some elliptic curve algorithms can be compromised during signature generation by a bad RNG: my understanding was that by a compromised RNG, the private key could be leaked.

From the documentation:


  Signatures are generated deterministically; key generation consumes new randomness but new signatures do not. This is not only a speed feature but also a security feature, directly relevant to the recent collapse of the Sony PlayStation 3 security system.


Granted that if your RNG is compromised, you're going to have a bad time in all regards, does Curve25519 suffer from this private key leak problem as well?
Any key generation algorithm for any cryptosystem is going to be weak if the attacker can predict what seed was used to generate the key. They can just generate the same key. However, assuming the the random number generator is not that bad, different algorithms start to look different.

If you are just using the output of the random number generator as a private key, Curve25519 (the encryption algorithm) will use that as the secret curve point. That means any structure in the output of the RNG might be visible. So whether it's theoretically exploitable depends on how broken the RNG is.

In contrast, in Ed25519 (the signature algorithm you linked to), the actual elliptic curve point is derived from the private key using a hash function. That means as long as there's enough entropy in the key that the attacker cannot guess it, there should be no visible structure to take advantage of, unless the hash function – SHA-512 – is also broken.

With Ed25519 it's about as good as it can get. The RNG is only used in key generation, signatures require no entropy and so aren't vulnerable. Even if the RNG was slightly biased, it should be hidden by the hash.