Sophie Schmieg writes: > From what I have heard from NIST, there are no current plans on > adding X25519 to the NIST approved curves, mostly in order to encourage > people to transition to PQC instead of ECC.
Sorry, which document are you referring to? This isn't in line with the NIST announcement quoted in my email dated 6 Jun 2024 00:14:24 -0000; it also seems hard to reconcile with the fact that NIST standardized Curve25519 and Ed25519 as part of updating its digital-signature standard in 2023. Could it be that you're thinking of the document https://web.archive.org/web/20150815072948/https://www.nsa.gov/ia/programs/suiteb_cryptography/index.shtml from NSA back in 2015? ("For those partners and vendors that have not yet made the transition to Suite B algorithms, we recommend not making a significant expenditure to do so at this point but instead to prepare for the upcoming quantum resistant algorithm transition.") > given that P256 has closed formulas these days the implementation > benefits are on par "These days"? Lange and I published complete formulas for P-256 in 2009. See my email dated 3 Jun 2024 12:33:10 -0000 for more on this and on the implementation benefits of X25519. ---D. J. Bernstein _______________________________________________ TLS mailing list -- tls@ietf.org To unsubscribe send an email to tls-le...@ietf.org
