3 ms·

NIST thinks that 2048 bit RSA will be secure until 2030. Presumably their analysis does not include a quantum computer, because if it did they wouldn't recommen

NIST thinks that 2048 bit RSA will be secure until 2030. Presumably their analysis does not include a quantum computer, because if it did they wouldn't recommend 3072 bit RSA for security beyond 2030. Their analysis is indexed against DES (so cracking 2048 bit RSA using the best known methods would be equivalent to cracking a hypothetical 112-bit DES). It's possible that you're right that a quantum computer won't exist in 2040 that will break 2048 bit RSA, but that doesn't mean it won't be broken anyway by then.

amirhirsch 8y ago
Of course, for all we know factorization is in P or even NC (as the GP notes, we don’t really have proofs). I’m more hopeful we will find a proof of P!=NC or P!=NP than there being a quantum computer that beats RSA2048 in 21 years. It aught to be lower-hanging-fruit to prove that factorization is not in NC (polylog depth, polynomial component circuit) and therefore NC!=NP => (P!=NP or NC!=P) so at least one of the two probably true statements is true...