It was the NSA who shocked [0] the world of cryptography by announcing "elliptic curve cryptography is dead under the threat of quantum computers, we must move

It was the NSA who shocked [0] the world of cryptography by announcing "elliptic curve cryptography is dead under the threat of quantum computers, we must move to Post-Quantum Cryptography ASAP and encourage its development." (common knowledge, uncontroversial), "therefore, if you are running a legacy system which had not yet upgraded from RSA to ECC, you should not bother to do so, and instead should save money for the future upgrade to post-quantum protocols." (WTF? Most people thought the threat of quantum computers is serious, but ECC should be good for another ten years, and one should should definitely upgrade to ECC, also, it's worth to revise the ECC standard to include newer curves). > In August 2015, the U.S. government’s National Security Agency (NSA) released a major policy statement on the need to develop standards for post-quantum cryptography (PQC). The NSA, like many others, believes that the time is right to make a major push to design public-key cryptographic protocols whose security depends on hard problems that can-not be solved efficiently by a quantum computer. The NSA announcement will give a tremendous boost to efforts to develop, standardize, and commercialize quantum-safe cryptography. While standards for new post-quantum algorithms are several years away, in the immediate future the NSA is encouraging vendors to add quantum-resistance to existing protocols by meansof conventional symmetric-key tools such as AES. Given the NSA’s strong interest in PQC, the demand for quantum-safe cryptographic solutions by governments and industry will likely grow dramatically in the coming years. Most of the NSA statement was unexceptionable. However, one passage was puzzling and unexpected: > <quote>For those partners and vendors that have not yet made the transition to Suite B algorithms, we recommend not making a significant expenditure to do so at this point but instead to prepare for the upcoming quantum resistant algorithm transition.... Unfortunately, the growth of elliptic curve use has bumped up against the fact of continued progress in the research on quantum computing, necessitating a re-evaluation of our cryptographic strategy</quote> > The NSA seemed to be suggesting that practical quantum computers were coming so soon that people who had not yet upgraded from RSA to ECC should not bother to do so, and instead should save their money for the future upgrade to post-quantum protocols. > Shortly thereafter, the NSA released a revised version in response to numerous queries and requests for clarification. The new wording was even more explicit in its negative tone on the continuing use of ECC: “...elliptic curve cryptography is not the long term solution many once hoped it would be. Thus, we have been obligated to update our strategy.” Although other parts of the statement assured the public that ECC was still recommended during the time before the advent of practical quantum computers,the overall impression was inescapable that the NSA was distancing itself from ECC. > In addition, people at the National Institute of Standards and Technology(NIST) and elsewhere have noticed that the NSA has not been taking an active part in discussions of new curves to replace the NIST curves that were recommended for ECC in 1999. The PQC announcement suggests that the NSA has no interest in this topic because it now views ECC as only a stopgap solution. The statement in fact advises against “making a significant expenditure” to upgrade to any of the Suite B algorithms, let alone to any new ECC standards using updated curves. Even industrial and government users who are using antiquated protocols should just sit tight and wait for post-quantum standards. This caught many people by surprise,since it is widely believed that ECC will continue to be used extensively for at least another decade or two. Later, NSA ordered the NIST to start the PQC competition - which I think is good for driving further development of PQC. But now, NSA research director is telling us "don't rush"? It doesn't make sense. [0] See the exceptionally good paper by Koblitz, et al. https://eprint.iacr.org/2015/1018.pdf https://eprint.iacr.org/2015/1018.pdf