It is interesting to see that Google decided to opt for NIST P-384 curve for the root certs it is going to have valid until 2036. Brian Smith has argued for su

It is interesting to see that Google decided to opt for NIST P-384 curve for the root certs it is going to have valid until 2036. Brian Smith has argued for supporting only P-256, P-384 and Curve25519: https://briansmith.org/GFp-0 https://briansmith.org/GFp-0. That said, Mozilla decided to continue to advertize support for P-521 for NSS (https://bugzilla.mozilla.org/show_bug.cgi?id=1128792 https://bugzilla.mozilla.org/show_bug.cgi?id=1128792). P-256 and P-384 are widely supported in various TLS libraries (SChannel, SecureTransport, OpenSSL, NSS), whereas Curve25519 doesn’t yet seem present in Microsoft or Apple’s libraries. I suppose with TLS 1.3 support perhaps we may see it implemented? Unfortunately it seems none of the NIST curves (P-*) are considered “safe” by DJB and Tanja Lange: https://safecurves.cr.yp.to/ https://safecurves.cr.yp.to/.