The cited paper[0] only increases my concern: > “But what if your adversary is NSA or Mossad? Won’t they have the computing capabilities to run a 280 attack?”

The cited paper[0] only increases my concern: > “But what if your adversary is NSA or Mossad? Won’t they have the computing capabilities to run a 280 attack?” Such a question is irrelevant. If your problem is to protect against such adversaries, the answer is probably not cryptography. Handwaving away better cryptographic security on the basis that they'll probably get what they want some other way does not work for me. This is likely and often true, but those other methods may be more expensive, be unusable without revealing their hand, or be politically or diplomatically sensitive. We should not give up on our security being as resistant as possible to these agencies on such a basis. [0] https://eprint.iacr.org/2019/1492.pdf https://eprint.iacr.org/2019/1492.pdf