Higher security constructions (using X448)

[tarcieri]

XSTREAM constructions providing security levels higher than 128-bit are not presently specified.

It would be possible using the X448 elliptic curve (i.e. the Montgomery form of Ed448-Goldilocks) for key agreement along with HKDF-SHA-512 for key derivation and AES-SIV/AES-PMAC-SIV in conjunction with AES-256. This curve uses a 448-bit field and provides a ~224-bit security level.

Libraries implementing X448 are a bit hard to come by, however.