Why is the NSA deprecating p256 ECDHE?

[petercooperjr]

@9peppe

But that's not what they did. They went and suggested a curve that's incredibly slow, incredibly unsupported by browsers. That's almost like saying "don't use ECDHE on .gov websites."

I have several curves configured on my webservers, including the NSA suggested one: "sect571r1, secp256k1, secp384r1 , secp521r1, x448" and excluding the two common, safe but not safest "secp256r1, x25519" -- and this config is pretty strong according to ssllabs, aes >256 equivalent.

I'm confused. I thought that secp384r1 and P-384 were two names for the same thing. For instance, ISRG Root X2's text dump says both names in it, one being an "ASN1" name and one being a "NIST" name. Or am I completely misunderstanding and they're referring to different parts of the encryption process and both are used? I'm far from an expert in all of this, just an amateur who knows that he knows just enough to be dangerous. I thought that this curve (the one Let's Encrypt uses for Root X2) was the one that NSA was recommending for elliptic curve based encryption, and that web browsers had reasonable support for it. It's just that P-256 is faster but has a shorter effective key length if I understand right.