I was a bit disapointed to see this post on RSA 896. There’s no new stuff here, just a lot of compute. However, it was a chance to try out the egress sniffer. I have talked to 5.3k SNI names in the last two weeks. about 10% are not reachable today. However, none are at 1k RSA. This is a not very surprising - very few CAs hand out many year certs, and CAs stopped with RSA 1024 a long time ago. The threat is decrypting very old saved messages.
| Key type | Bits | Hosts |
|---|---|---|
| RSA | 2048 | 2,883 |
| EC (P-256) | 256 | 1,877 |
| EC (P-384) | 384 | 45 |
| RSA | 3072 | 8 |
| RSA | 4096 | 6 |