I’m a bit miffed after just a couple paragraphs. My reading of the original article was that the issue of people feeling tempted to implement RSA was just exacerbating the problem of how difficult it is to implement RSA securely.

I am not a cryptographer. I’d be rather cautious about implementing my own cryptography at all, less with my own code implementing the primitives. That said, Trail of Bits makes a compelling argument, that, in my reading, RSA is harder to get right in subtle ways, whereas ECC is just hard to grok period. A bad RSA implementation leads to weak cryptography, but a bad ECC implementation often leads to something that doesn’t work at all.

This, alongside other benefits of ECC like smaller key sizes for similar cryptographic security, faster and simpler key generation, more idiot-tolerant properties, etc. makes ECC an obvious choice even disregarding if you can implement RSA. It’s just that people like to choose RSA because they feel like they understand it, but the truth is they only understand the surface-level basics. (To be fair, me too. Though I feel I also can grok some surface-level basics of some ECC-based algorithms, too.)

Feel free to flame me for not reading the article entirely; I definitely earned it. But that opener made me not want to, sorry.