13Nis
More secure curve than Curve25519
As far as I know, Curve25519 offers "only" a security level equal to an 128bit symmetric cipher. I'd like to know if there are new (not NIST) curves, which provide a security-level comparable to a 256bit cipher AND already used by some applications?
As far as I know, there are curves like E-521 or M-511 which have a very high security margin, but I don't know any implementation which is currently using them.
(Btw., I know that 128bit is considered secure, but it seems a little bit weird that we often use 256bit symmetric ciphers combined with 4K-RSA or an 256bit curve.)
