<i>&gt; ElGamal Elliptic Curve Cryptography</i><p>(384-bit prime) - Why not just use X448 since that&#x27;s now an Internet Standard?<p><i>AES-256-CCM</i> is an <i>interesting</i> choice. At least it&#x27;s an AEAD mode.<p>It also uses Fortuna for IVs, etc. instead of directly &#x2F;dev&#x2F;urandom (or window.crypto in JS land). Userspace CSPRNGs are a devastatingly stupid idea.<p>Where is the identity verification (&quot;How do I know I&#x27;m speaking to the correct public key?&quot;)?<p><i>&gt; Europeans: Did you know that when you use U.S. cloud services, your data is stored under US jurisdiction, and handled under under the Patriot Act? This means that a foreign government can inspect your or your client&#x27;s data even without informing you.</i><p>FUD. Where you host the data shouldn&#x27;t matter, because the server should never be given access to your plaintext.<p>My advice: Avoid like the plague.