Because it's supported, not yet broken, and not from a government agency whose loyalty to its people is questionable. The EC curves from NIST[1]: > cryptograp

Because it's supported, not yet broken, and not from a government agency whose loyalty to its people is questionable. The EC curves from NIST[1]: > cryptography experts have also expressed concern over the security of the NIST recommended elliptic curves C.f. [this comment and the thread of comments nearby][2], where this, and some other concerns, are discussed. But the concerns about hidden numbers from a government agency in a world where we know what we know from Snowden just kills the NIST curves for me. I'd happily use Curve25519/Ed25519 over RSA, if it is supported, but that's the trick. AFAIK, TLS 1.3 supports it, but the CA/B forum does not, meaning CAs won't issue such certificates, since they're bound by those rules. ACME, AFIAK, also does not support Ed25519 yet, though I believe there are plans in motion to do so. SSH is about the happiest story: it's well supported by OpenSSH. Aside from that, as a dev, I try to let well-known TLS libraries handle the encryption for me, as much as possible. (But even that is hard; many tools/libraries make it incredibly easy to generate invalid certs, short keys, fail to correctly validate a supplied certificate, etc.) Or push it over SSH. [1]: https://en.wikipedia.org/wiki/Elliptic-curve_cryptography https://en.wikipedia.org/wiki/Elliptic-curve_cryptography [2]: https://news.ycombinator.com/item?id=20382720 https://news.ycombinator.com/item?id=20382720