Wow, I disagree with him about the relative security of RSA vs. ECC. First, ignoring any clues from NSA's behavior entirely, RSA attacks have gradually gotten better, and an RSA/DH-based system with 256-bit security would be very slow (3072-bit RSA keys).<p>Second, I really doubt NSA's recommendations for Suite B algos are head fakes, because the public justification for them makes sense and head faking doesn't. US and allied governments can't use secret algorithms everywhere, and their systems need to talk securely. And they seem to actually be using Suite B, so it would be an expensive, risky head fake to standardize your whole government around something you know can in principle be cracked (even if you think only you can currently do it). On the other hand, I think it doesn't matter to NSA much if Suite B reveals that NSA thinks 521-bit ECDH is OK; notice how it hasn't led to ubiquitous ECDH usage.<p>2.5th, if all the latest hints mean they're breaking tons of real traffic with a mathematical breakthrough, it's got to be in implementing RSA cracks, because most real traffic isn't using ECC. (Schneier admitted that might be possible when a "crypto breakthrough" claim came out early last year: <a href="http://www.schneier.com/blog/archives/2012/03/can_the_nsa_bre.html." rel="nofollow">http://www.schneier.com/blog/archives/2012/03/can_the_nsa_br...</a>)<p>But there is at least one way to deal with an unresolvable uncertainty about which of two algos is badly broken. For secure one-to-one communications, you only need to establish a secure session once, then keep a secret key stashed for secrecy and authentication (auth through MACs or authenticated encryption, not signatures). So just frickin' use both: do two key negotiations, hash the results to get your key, and don't worry how slow it is because chips are fast and you only need to do this once.<p>Anyway, I do echo Schneier that the math is probably not the weakest point; it's consistent with experience in the world outside, where there are far more bugs and so on than algorithm failures (though algo failures happen, e.g., the 2008 MD5 SSL break). And it's consistent with all the other NSA leaks, which are mostly about non-cryptographic ways to data. Regaining some privacy looks like a long and difficult process.