So Curve25519 is pretty much rock solid unless (a) someone discovers genuinely new math or (b) we get a practical quantum computer with enough coherent qubits to actually run the ECC variant of Shor&#x27;s algorithm.<p>Note the qualifications around (b). Just any QC would not do... it would have to (as far as I know) have a rather &quot;wide&quot; coherent qubit capacity among other characteristics.<p>So what... Curve25519 until 2050? 2100? Hard to say and new math is always a total wildcard, but it seems damn secure.<p>... and as you say DH and RSA are also great with &gt;2048 bits. 4096 bits is what I typically use.