Relevant reading from Koblitz and Menezes:
https://eprint.iacr.org/2015/1018.pdfsecp256k1 is a Koblitz curve.
Abstract. In August 2015 the U.S. National Security Agency (NSA)
released a major policy statement on the need for post-quantum cryptography
(PQC). This announcement will be a great stimulus to the
development, standardization, and commercialization of new quantumsafe
algorithms. However, certain peculiarities in the wording and timing
of the statement have puzzled many people and given rise to much
speculation concerning the NSA, elliptic curve cryptography (ECC), and
quantum-safe cryptography. Our purpose is to attempt to evaluate some
of the theories that have been proposed.
One possibility:
5.5. The NSA has a political need to distance itself from ECC.
There were some peculiarities in the release of the August 2015 statement
about preparing for post-quantum crypto. Normally all of the big corporations
that do cryptographic work for the U.S. government would have been
given some advance notice, but this was not done. Even more surprising,
the NIST people were not asked about it, and even researchers in IAD were
caught by surprise. It seems that whoever at the NSA prepared the release
did so with minimal feedback from experts, and that includes their own
internal experts.
This suggests that the main considerations might not have been technical
at all, but rather Agency-specific — that is, related to the difficult situation
the NSA was in following the Snowden leaks. The loss of trust and credibility
from the scandal about Dual EC DRBG was so great that the NSA might
have anticipated that anything further it said about ECC standards would
be mistrusted. The NSA might have felt that the quickest way to recover
from the blow to its reputation would be to get a “clean slate” by abandoning
its former role as promoters of ECC and moving ahead with the transition
to post-quantum cryptography much earlier than it otherwise would have.
