It's more likely because you can't achieve modern security levels with cryptosystems built on the DLP or IFP at acceptable performance.
Suite B aims for 128-bit or 192-bit security levels; for comparison 1024-bit modulus RSA is currently thought to provide 73-bit security.
(The next natural question is why the internet community is still failing to widely deploy cryptosystems with appropriate security levels. I don't know. But HTTPS, OTR and DNSSEC are all built of cheese in this respect.)
Comments
Or non-EC DH, either. (It does include ECDH.)
Perhaps they were simply anticipating DLP progress and wanted to be future-proof?
It's more likely because you can't achieve modern security levels with cryptosystems built on the DLP or IFP at acceptable performance.
Suite B aims for 128-bit or 192-bit security levels; for comparison 1024-bit modulus RSA is currently thought to provide 73-bit security.
(The next natural question is why the internet community is still failing to widely deploy cryptosystems with appropriate security levels. I don't know. But HTTPS, OTR and DNSSEC are all built of cheese in this respect.)