[g-b-r]

We do all have ECC in our cryptosystems right now, and given how long it's been there, we can rely on its security much more than something new.

[tptacek]

So clearly when I go look back at the archives of Bernstein discussing 25519, I'm going to see him advocating for FFDH/25519 cascades, right?

(If my subtext wasn't clear, by the way: the implementation history of ECC is godawful.)

[g-b-r]

Was FFDH considered safe?

> the implementation history of ECC is godawful

You do know that new cryptographic code can be godawful, then?