Hi, On the topic of the relative difficulty/complexity of factoring RSA1024, one should be interested in the analysis contained in https://eprint.iacr.org/2010/006.pdf, where sieving for RSA1024 is benchmarked as 1000x that of RSA768, and later, due to improvements in polynomial selection http://www.ams.org/journals/mcom/2016-85-298/S0025-5718-2015... , 490x compared to the RSA768 result.
> Forseeable, but not immediate
This was the open source outspin of the NSA with French SW. You have to assume that internally with their own HW and SW they are at least 100x better, not counting Shor with their Quantum Computer, which should have around 2000 qbits.
$ python3 /tmp/t.py complexity of 762, 89775939935689957703680.000000 relative complexity of 762 to 762 , 1.00
complexity of 1024, 131584429444916036885282816.000000 relative complexity of 1024 to 762 , 1465.70
complexity of 2048, 153297054278133875964680175492268032.000000 relative complexity of 2048 to 762 , 1707551649004.70
complexity of 4096, 128907209987952013910454741738429736597460090880.000000 relative complexity of 4096 to 762 , 1435877029862269597515776.00
$
Feels like the rise by bitlength is non-linear. So, moving to RSA2048 has significant benefit against 1024, to the extent 1024 is tractably weak against 762, but I am still feeling this does not point to an immediate, apparent threat to 1024.
Forseeable, but not immediate.