Recently, the NSA (re-published?) their CNSA guidelines and some information on post-quantum computers (per the title of the document).
Here's the link for convenience (document is titled, 'Quantum Cryptography and Post-Quantum Computing' if you'd rather not go straight to the link)
Question about P-256 Removal
The noticeable difference in the new suite is that, at a minimum, EC-384 strength keys are recommended. Reading through the document, it appears these standards are not just for the public sector or private contractors handling classified documents, but rather everyone (public and private).
For example, one the posed questions on their sheet is, "The data I have on my particular NSS only requires protection for a short time. Do I really need to comply with the increased algorithm strengths of CNSSP-15?" (keeping in mind the only 'increase' in strength here was via dropping SHA-256 & EC-384).
The answer given to that question was, "NSA mandates transitioning algorithms for NSS in order to conform to a common standard and to ensure interoperability. NSS developers and operators should transition to comply or consult with NSA about the issues involved in their specific scenario."
I take this to effectively mean that at the time they published that, EC-256 & SHA-256 are to be considered dead in the water.
I pulled up the NIST SP 800-56A Rev3 to gather more information and that document essentially states that even unclassified data seems to be a no-go when it comes to curves below EC-384.
They state, "D/As planning to deploy ECC with P-256 likely require a further change (e.g., to P-384) before quantum-resistant algorithms reach sufficient market penetration." They state that the intent is to avoid as many "hops" as possible(?), then finish by stating, "Therefore, D/As planning to deploy ECC with curves other than P-384 to protect UNCLASSIFIED NSS or to provide community of interest separation consult with NSA before proceeding."
This blog post by 'Atsec Security' suggests that the transition needs to be made and completed by September 2021 (just passed).
Verdict on Other Structures Relying on 128-bit Strength Crypto
Obvious examples here start with Bitcoin and all cryptocurrencies. Bitcoin uses secp256k1 & SHA-256. Since Bitcoin just topped a valuation of $1 trillion today, one can assume that if there is any cryptanalytic method that someone has found that is within the realm of practical (i.e., can crack at least one key within a year, maybe; I don't know, that's over my head), then this entire protocol is in trouble.
Would you all agree or disagree? And if you disagree, why? Also, Cloudflare has been issuing certificates that are default EC-256 / SHA-256 strength for some time. Can the connection to those sites still be considered secure?
I wanted to come here first to hear from the experts before spreading any disinformation / panic elsewhere.