> NSA used to push pretty hard for moving to elliptic curve from RSA. There was some speculation they already knew better factoring methods that worked for brea

> NSA used to push pretty hard for moving to elliptic curve from RSA. There was some speculation they already knew better factoring methods that worked for breaking RSA. Just to add a bit more detail... NSA was pushing EC pretty hard for a bit. Then, after a while, they switched gears and said (and I'm paraphrasing here, obviously), "Actually, don't worry about it. If you've already switched to EC, that's fine, just stick with it. If you're still on RSA, though, just stick with that. There's no need to switch, both are fine (for the time being)." So who knows WTF they were thinking. Unfortunately, it's impossible to get any real "signal" from their statements since they can no longer be trusted. They could be legitimately looking out for our best interests or they could be trying to get everyone to use less secure algorithms -- and we have no way to know which it is! (Personally, I've just carried on normally and pretended like they never said anything at all).