That is, if it costs very little to have larger keys, why not have larger keys?
It is essentially hedging your bets as even if quantum computing key factorisation works, key lengths will still have an impact on the difficulty of factorisation, and it may make a difference in terms of practicality.
> Quantum computing of the sort intended to break RSA involves a breakthrough in both computing and algorithms. Normally some sort of new computing technology is invented and then algorithms are designed to enable that technology to do something useful. The quantum computing threat to RSA is different. We now have the algorithm (Shor's) but the computer to run it on only exists in our imagination.
> If someone were to invent such a computer then RSA 2048 would be immediately and trivially breakable. RSA 3072 would also be trivially breakable. The same applies to RSA 4096 and 8192.
By costs nothing I mean as CPUs get faster there is less performance impact on lenghtening keys
I mean, the whole thing with quantum computer factoring is it scales well. Getting to 2048 rsa seems really really difficult. But if we ever get there, getting to 4096 is probably just a tiny extra step.
Would love to be proven wrong though if my understanding is incorrect and there's actually a feasible path towards quantum computing at scale.
Anyways, my point was that getting a quantum computer at a decent scale is really difficult. If we manage to overcome that burden somehow, the difference between 2048 bit rsa abd 4096 bit is peanuts.
No one can know at the moment, hence the trade off, if it costs very little to do a longer key, why not do a longer key?
1. it's reasonable to assume the NSA is a decade ahead and has more computers than academia.
2. you want your secrets to last a decade (or longer)
3. the total amount of data you're encrypting per client is only 256 bits anyway (the size of a symmetric key) so the absolute performance impact is relatively minimal