[tptacek]

Schneier's comment is misinformed, and Schneier has had a bias against ECC going back over a decade, which has, I think, kept him from learning as much about it as he's picked up about RSA. Schneier has published no research about ECC, and details of curve crypto are absent from his books.

It's worth keeping in mind that Schneier is also not an academic cryptographer, or really a serious practicing cryptography researcher of any sort. He's a great popularizer and he works with some very credible other researchers, but "Schneier said so" is never going to win a debate among cryptographers.

Bernstein makes the same kinds of comments about the Brainpool curves (the whole point of BADA55 was that the Brainpool curves aren't that much more trustworthy than the Solinas curves), and nobody, including Bernstein, will with a straight face say that the Brainpool curves are backdoored.

It's a valid process critique that has been interpreted by laypeople as an accusation, which is something Bernstein has taken flak for.