Bottomley: Using Elliptic Curve Cryptography with TPM2

> Don't think of the NSA attacks on DH as people using key sizes that were too small. Rather, the salient lesson is that when enough people are using shared parameters the economic calculus applied for choosing key sizes can be substantially impacted if you don't take account of that fact.

That has to be taken into account for sure, but I disagree that using non-shared parameters is the way to go. If you have to rely on multiple targets taking longer to attack it means the choices are already broken since attacking one target is possible (or close to so).

This is also the case in many symmetric algorithms. Multi-target attacks are cheaper than attacking each individually, and breaking someone's key is faster than breaking a particular key.

The solution is to choose parameters such that without advances in theory any amount of computational power will be insufficient to break any key. The same should be possible with ECC.