> However, it also recommends RSA & classic Diffie-Hellman over multiplicative groups of integers, while Suite B exclusively recommended elliptic curve-based pu

> However, it also recommends RSA & classic Diffie-Hellman over multiplicative groups of integers, while Suite B exclusively recommended elliptic curve-based public-key crypto. I think their reasoning is probably along the lines of "large RSA keys will buy you a little bit more time to migrate than small ECC keys if a quantum computer emerged today, due to memory constraints with what we think quantum computer will look like".