The http://www.keylength.com http://www.keylength.com website mentions various standards suggesting key lengths. For example, from ECRYPT II Recommendations (20

The http://www.keylength.com http://www.keylength.com website mentions various standards suggesting key lengths. For example, from ECRYPT II Recommendations (2012) there's a mention of 2432 bit giving reasonable protection up to the year 2030. There's also a nice answer on the crypto stack exchange: http://crypto.stackexchange.com/a/1982 http://crypto.stackexchange.com/a/1982 Reviewing the sources, I admit "many more decades" might be an overestimation, maybe "a couple decades" would be a more accurate statement. Still, the current factorization record is only 768 bit, and even the lowly 1024 bit key is orders of magnitude stronger than that.