[NIST SP 800-57](http://csrc.nist.gov/publications/nistpubs/800-57/sp800-57_part1_rev3_general.pdf) §5.6.1 p.62–64 specifies a correspondence between RSA modulus size $n$ and expected security strength $s$ in bits:

    Strength  RSA modulus size
      80        1024
     112        2048
     128        3072
     192        7680
     256       15360

This works out to approximately $s \approx 4 n^{0.43}$ (but I have no idea whether my extrapolation means anything; strengths up to 112 are indexed on DES while strengths 128 and above are indexed on AES, i.e. the strength is the difficulty of brute-forcing the corresponding symmetric algorithm with the specified key size).

What are these numbers based on? Do they come from the expected complexity of the best known factorization methods? Or are they extrapolation from the amount of computation in specific factorization efforts such as for [RSA-768](http://eprint.iacr.org/2010/006.pdf) (which “required more than $10^{20}$ operations”)?

(I'm asking for more precise information than http://crypto.stackexchange.com/questions/2612/difficulty-of-breaking-rsa-for-a-given-key-size. http://crypto.stackexchange.com/questions/1978/how-big-an-rsa-key-is-considered-secure-today/1982#1982 has a nice history of RSA factorizations, but doesn't answer my question — is that what the strength estimates are based on?)