On: How is NSA breaking so much crypto? (2015)

[bouncycastle]

Elliptic curves produce smaller keys which meant that addresses could take up less space and be more portable, so perhaps that was part of the motivation.