It’s not quite a doubling per bit, which is why RSA keys are relatively large compared to similar-strength ECDSA keys, for example.

Steve Weis, who has been doing RSA factoring on some large GPU clusters, estimates factoring 1024-bit RSA would take about 2000 GPU-years, which is well within the range of anyone with a serious budget.

▲

throwawayk7h an hour ago | parent [-]

out of curiosity, how long would 2048-bit RSA take to factor?

	▲	mcpherrinm an hour ago \| parent \| next [-]
		It's hard to extrapolate that far, but maybe hundreds of thousands or millions of years. Naively looking at scaling factors is going to be tricky, because computation of this scale is going to involve things like "how do I hijack every GPU on the planet", or worrying about when the sun will run out of hydrogen.
	▲	mitxela an hour ago \| parent \| prev \| next [-]
		https://en.wikipedia.org/wiki/Key_size#Asymmetric_algorithm_... says approximately the same as a 112-bit symmetric key, so 1/65536 as fast as however your target platform does at AES128, but probably 2000 times slower again because RSA is a really slow algorithm. 128-bit security is the de-facto minimum standard. Anything less than that is suspect. That's a 3072-bit RSA key. We only ever tolerated shorter keys because RSA is so slow. You should switch to ed25519 if you can.
	▲	entrope an hour ago \| parent \| prev [-]
		2048-bit RSA gives something like 28 more bits of security than 1024-bit RSA has, so it would take about 250 million times as long to factor one 2048-bit key.