I wonder whether I might not be able to convince you that RSA is less conservative than ECC. Certainly, I haven't once tested a piece of real-world software that got it right. Did you see that just the other day, a team managed to resurrect the PKCS1v15 padding oracle in JSSE? Is RSA plus OAEP really simpler than just using a curve to derive a key to encrypt with?
Comments
I wonder whether I might not be able to convince you that RSA is less conservative than ECC. Certainly, I haven't once tested a piece of real-world software that got it right. Did you see that just the other day, a team managed to resurrect the PKCS1v15 padding oracle in JSSE? Is RSA plus OAEP really simpler than just using a curve to derive a key to encrypt with?