I was checking for authoritative sources to back up my recommendation of a minimum RSA key length of 1024 and was shocked to find that NIST 800-56Br1 and FIPS 186-4 both recommend at least 2048 bits with 3072 bits for TOP SECRET data. I found that other sources have similarly high recommendations based on expected lifetime of the key.

These recommendations seem excessive in light of what I can find about attacks against RSA encryption. As far as I can find, the most recent attempt to factor RSA numbers was the successful factoring of the 756 bit RSA number. That was in 2009 and required, roughly, two years of effort with 100 computers and a team of mathematicians. Those researchers noted that their methods would not scale to significantly larger RSA numbers, so other [and unknown] methods would need to be developed.

Given that each additional bit doubles the number of values, 1024 bits would have 2^256 times as many possible values. Even given very sparse utilization of that immense field, the effort required to attack a 1024 bit RSA key appears very far outside the reach of current capabilities.

Have I missed some more recent attacks? I note that some of the recommendations I have found predate the 2009 paper. Why would cryptanalysts believe that 1024 bit RSA keys would be insufficient when no one had even attacked the 756 bit key, which is vastly easier than 1024?

Can anyone point me to cryptanalytic work that demonstrates the risk to 1024 bit RSA?

I was checking for authoritative sources to back up my recommendation of a minimum RSA key length of 1024 and was shocked to find that NIST 800-56Br1 and FIPS 186-4 both recommend at least 2048 bits with 3072 bits for TOP SECRET data. I found that other sources have similarly high recommendations based on expected lifetime of the key.

These recommendations seem excessive in light of what I can find about attacks against RSA encryption. As far as I can find, the most recent attempt to factor RSA numbers was the successful factoring of the 756 bit RSA number. That was in 2009 and required, roughly, two years of effort with 100 computers and a team of mathematicians. Those researchers noted that their methods would not scale to significantly larger RSA numbers, so other [and unknown] methods would need to be developed.

Given that each additional bit doubles the number of values, 1024 bits would have $2^{256}$ times as many possible values. Even given very sparse utilization of that immense field, the effort required to attack a 1024 bit RSA key appears very far outside the reach of current capabilities.

Have I missed some more recent attacks? I note that some of the recommendations I have found predate the 2009 paper. Why would cryptanalysts believe that 1024 bit RSA keys would be insufficient when no one had even attacked the 756 bit key, which is vastly easier than 1024?

Can anyone point me to cryptanalytic work that demonstrates the risk to 1024 bit RSA?

I was checking for authoritative sources to back up my recommendation of a minimum RSA key length of 1024 and was shocked to find that NIST 800-56Br1 and FIPS 186-4 both recommend at least 2048 bits with 3072 bits for TOP SECRET data. I found that other sources have similarly high recommendations based on expected lifetime of the key.

These recommendations seem excessive in light of what I can find about attacks against RSA encryption. As far as I can find, the most recent attempt to factor RSA numbers was the successful factoring of the 756 bit RSA number. That was in 2009 and required, roughly, two years of effort with 100 computers and a team of mathematicians. Those researchers noted that their methods would not scale to significantly larger RSA numbers, so other [and unknown] methods would need to be developed.

Given that each additional bit doubles the number of keys, 1024 bits would have 2^256 times as many keys. Even given very sparse utilization of that field, the effort required to attack a 1024 bit RSA key appears very far outside the reach of current capabilities.

Have I missed some more recent attacks? I note that some of the recommendations I have found predate the 2009 paper. Why would cryptanalysts believe that 1024 bit RSA keys would be insufficient when no one had even attacked the 756 bit key, which is vastly easier than 1024?

Can anyone point me to cryptanalytic work that demonstrates the risk to 1024 bit RSA?

I was checking for authoritative sources to back up my recommendation of a minimum RSA key length of 1024 and was shocked to find that NIST 800-56Br1 and FIPS 186-4 both recommend at least 2048 bits with 3072 bits for TOP SECRET data. I found that other sources have similarly high recommendations based on expected lifetime of the key.

These recommendations seem excessive in light of what I can find about attacks against RSA encryption. As far as I can find, the most recent attempt to factor RSA numbers was the successful factoring of the 756 bit RSA number. That was in 2009 and required, roughly, two years of effort with 100 computers and a team of mathematicians. Those researchers noted that their methods would not scale to significantly larger RSA numbers, so other [and unknown] methods would need to be developed.

Given that each additional bit doubles the number of values, 1024 bits would have 2^256 times as many possible values. Even given very sparse utilization of that immense field, the effort required to attack a 1024 bit RSA key appears very far outside the reach of current capabilities.

Have I missed some more recent attacks? I note that some of the recommendations I have found predate the 2009 paper. Why would cryptanalysts believe that 1024 bit RSA keys would be insufficient when no one had even attacked the 756 bit key, which is vastly easier than 1024?

Can anyone point me to cryptanalytic work that demonstrates the risk to 1024 bit RSA?