On: Lessons from the History of Attacks on Secure Hash Functions

[hannob]

They're far older than 2000.

My point was: Modern ECC (X25519 and friends) are the only post-2000 invented mainstream algs where any realistic breakage is in sight.

[CiPHPerCoder → hannob]

And only if large quantum computers are possible. If it turns out they're not, X25519/Ed25519 are safe.

But I'm not willing to be the farm on that risk. PQCrypto, please. :)