@e-sushi Because elliptic curves over prime fields are more popular.
AFAIK cryptographers have higher confidence in their security, so it seems inconsistent for somebody who's paranoid enough to use >512 bit curves to use the less trusted binary curves over prime curves.
@CodesInChaos Paranoia is less of an issue… like I write before: I’m just trying to fill potential "R&D" gaps. Are you aware of any papers handling analysis of curves bigger than 512 bit (prime or non-prime)?
I haven't seen a normal elliptic curve with more than 521 bits.
It's clearly not possible to break those with the existing algorithms, so the only point in using a bigger curve is that you fear better ECDL algorithms that break small curves but not large curves.
