Comment by hnaccount_rng
2 hours ago
You are right that there are better options and there is no excuse not to choose something better today. But that’s not what GP is arguing! It’s just that: For any given interest level there is no way that expending the resources to attack the RSA key is valuable! You are either willing to expend resources then attacking the owner is far cheaper or not then you are also not investing weeks-to-month of cluster time.
And from that perspective RSA-1024 is still perfectly adequate
You don't know that. We're at the point where the NSA can assuredly break RSA-1024. We know they have sufficient processing power, and it would be silly of them not to have developed that capability.
"But they're not going to spend resources breaking my router!" No, not your router specifically. But batch GCD gives sqrt speedup over multiple keys, potentially 10's to 100's of millions of keys at once with off-the-shelf GPU clusters. Looking at that many keys at once tends to discover low-entropy biases common in consumer router hardware, which makes brute-forcing new keys from those devices trivial to do.
If you are actually operating a service relying on RSA-1024 security, it is almost certainly pwoned.