Curve448 also exists, which uses ~448-bit keys. Although with that, it only offers 224 bits of security (Compared to Curve25519's 128). And NIST-P521 exists, wi

Curve448 also exists, which uses ~448-bit keys. Although with that, it only offers 224 bits of security (Compared to Curve25519's 128). And NIST-P521 exists, with similar properties. I wonder whether this legislation strictly applies to the bits-of-security, or bits-of-key-length. IIUC, AES-256 will be fine for the forseeable future, even with quantum computers. However, Curve25519 could fall relatively soon, depending on how rapidly quantum computing advances.