28 of 32 Polish

TL;DR: no longer unconditionally.

As of 25 September 2018, the Bitcoin miners hashed at an aggregate rate of $\approx60 \cdot10^{18}H/s$ according to this source, where one hash is two nested SHA-256; that is $\approx2^{91.6}$ SHA-256 per year. That's been bitcoin's "peek hash" so far.

Here is this data redrawn in SHA-256 per year with a $\log_2$ vertical scale, to facilitate comparison with key size in bits. I believe the notable growth in 2010-2011 was the rise of GPUs, while the 2013-2014 period corresponds to an increased use of ASICs. Nowadays, bitcoin mining is mostly performed using highly specialized ASICs, some reportedly using 16nm technology and having represented a sizable market for silicon foundries.

Bitcoin mining SHA-256 hash rate per year

Thus 80 bit of security can not blindly be said good enough today. 80-bit may be very safe, or clearly not enough, depending on a variety of factors;

  • Value of the target
  • Time frame during which a break makes sene
  • How easier (or harder) it is to check a key compared to SHA-256, due to
  • Possibility of multi-target attacks, where the attacker's goal is to find any one in several target keys, and s/he manages to make the cost of testing a candidate key against all target keys less than linear in the number of target keys. That's sometime straightforward (when a ciphertext block for the same known plaintext block is available block-enciphered under all the target keys). Parallel rainbow tables can enable such multi-target attacks in more contexts.

Addition: I second everything in Thomas Pornin's answer (Feb. 2014), except perhaps "Right now, 80 bits still seem quite sturdy" which is only valid in some contexts, including the context of the question.

In the context intended for KATAN (really low-end devices such as RFID tags), an expectable consequence of key recovery is to be able to clone one single RFID tag. Recovering the key is likely feasible at far lower cost than brute force, by side channel attack or micro-probing, regardless of key size (even though testing a KATAN key requires significantly less work than performing one SHA-256). So right now (Nov. 2015), 80 bits of key is not a major weakness for an individual RFID tag key on rational economic grounds (if we discount the irrationally devastating effect of the announce of any break, and the more rational desire to not have to argue on key size if such break occurs). 80 bits would not be enough for the master key from which the RFID tag keys are derived, or some other uses of KATAN.