Bah, that's embarrassing. I will break the HN etiquette and reply to myself, because I will not succumb to editing the post above and retroactively fix a calcul

Bah, that's embarrassing. I will break the HN etiquette and reply to myself, because I will not succumb to editing the post above and retroactively fix a calculation error. Whatever comes from that, I deserve it. I was off by 2^10. For some reason I kept thinking the 72 bits as 82 bits. You can even see that from the numbers! So yes, 72 bits is not enough anymore. I stand corrected. New ballpark figure for sensible security margin should be 96 bits.