Can someone explain to me why RSA 2048 is "recommended to change"? It's still the default for gpg keys and as far as I know is widely thought to be secure for at least few hundred years!
It could have to do with the NSA's August 2015 plan for transitioning to quantum-resistant algorithms. In their new Commercial National Security Algorithm (CNSA) Suite, they advise a minimum 3072-bit RSA modulus:
(Doh... I don't know why I'm getting an invalid certificate authority error when trying to access that site, but Qualys SSL Labs confirms it's a real error. Yikes.)
They're DOD so why not. There's a lot of them that do. What confused me was that browsers in US didnt trust DOD PKI... probably quite reliable... while they have plenty of shady, less-secure CA's on their list.
For anyone reading the thread, this is an absolute must-read paper if you're at all interested in the near-future of production cryptosystems in high-risk settings.
Without commenting at all on the practicalities of attacking it, it's reasonable to expect a higher level out of security from GPG than a standard TLS connection.
Your web server needs to key and manage many connections/sec, and any delays feed back into my web developers further arguing against the use of TLS. You can generally expect no one will be trying to break your current TLS sessions ten years from now. If that doesn't apply to your situation, you probably have bigger problems, such as the broken CA model.
Both of these scenarios may be different with GPG.
It's probably not secure for a hundred years because of quantum computers. But none of the currently supported algs in openssh protects against quantum computers, therefore there's nothing you can do against it right now.
The arguments for using a longer modulus all reduce down to "you'll have to eventually, why not now?" rather than any new threat against 2048-bit modulus keys.
