> I'd imagine that 4096 will become the new minimum over the next few years. That's unlikely to happen. 2048-bit RSA provides a security level of ~112 bits, w

> I'd imagine that 4096 will become the new minimum over the next few years. That's unlikely to happen. 2048-bit RSA provides a security level of ~112 bits, which would physically require a massive amount of energy to break, and it's unlikely that so much energy would ever be expended on a single task. So 2048-bit RSA is only likely to be broken if there's a mathematical breakthrough against RSA. The thing is, such a breakthrough is likely to break 4096-bit RSA as well, so using 4096-bit RSA is only a protection against a minor breakthrough. Meanwhile, 4096-bit RSA carries a massive performance cost. It's just not worth slowing down your TLS handshake with 4096-bit RSA to protect against a mathematical breakthrough, but not too much of a breakthrough. So stick with 2048-bit RSA for now, and in a few years when elliptic curve crypto is better supported, switch to that.