First thing I thought, when reading the linked article: "Oh my god". This is extremely bad. Think what would happen if you deployed RSA with 256-bit keys for

First thing I thought, when reading the linked article: "Oh my god". This is extremely bad. Think what would happen if you deployed RSA with 256-bit keys for HTTPS and SSH (for host and user key-pairs). If the results reported above are correct, then we are now effectively at such a situation. Many top websites do use ECDHE with 256-bit (or shorter) ephemeral keys. Many people do relay on 256-bit keys for SSH host and user authentication. People will be able to decrypt new and previously sniffed HTTPS sessions, SSH sessions, will be able to log into your SSH servers, MITM your SSH connections (by computing the private ECDSA host key). IIRC previously you needed in the order of 2^128 operations to break ECDLP for 256-bit keys (and ECDHE ECDSA). Now that goes down to 2^(256/24), shortening effective key-size 12-fold (resulting in a speedup of factor 2^117). I'm not an expert in the field, so take these estimations with a large grain of salt. Corrections welcome. Update: on a second thought, it is April 1st today. Anxiously waiting for confirmation of hoax.