The document specifies that SHA-1 in HMACs is the be entirely disallowed after 2030. That seems like it would cause needless reimplementation of systems with the associated chance of security problems and expense. SHA-1 used in an HMAC is generally known to be secure.
> The 2048 deprecation in 2030 seems to be about quantum resistance, not about a move to 4096 bit RSA.
From [0], where the 112-bit 'security strength' of 2048-bit RSA is ultimately pulled from:
"The comparable security strengths provided below are based on accepted estimates as of the publication of this Recommendation using currently known methods. Advances in factoring algorithms, general discrete-logarithm attacks, elliptic-curve discrete-logarithm attacks, and other algorithmic advances as well as quantum computing may affect these equivalencies in the future. New or improved attacks or technologies may be developed that leave some of the current algorithms completely insecure."
Their recommendation is to switch to 3072-bit RSA or higher by 2031, since that has a 128-bit 'security strength' by their formula. So I don't think this has much to do with quantum resistance: as GP says, no reasonable RSA key size will help much with that.
>Currently, a 112-bit security strength for the classical digital signature and key-establishment algorithms does not appear to be in imminent danger of becoming insecure in the near future, so this approach should allow an orderly transition to quantum-resistant algorithms without unnecessary effort for the cryptographic community.
I get from this that NIST thinks the quantum threat is significantly greater than the threat from advances in classical computing hardware or algorithms. So we are to not to bother with transitioning from 112 bit to 128 bit equivalent strength and to concentrate on post quantum stuff. As a result stuff like 2048 bit RSA is now allowed at the "deprecated" level where it was previously "disallowed" after 2030.
It seems that both the quantum and classical threats both currently depend on a fundamental breakthrough so I am not sure how legitimate this policy is. It is reminiscent of the NSA suggestion to not bother transitioning to elliptic curve based methods and skip directly to post quantum methods.
Deprecating RSA-2048 for other reasons doesn't make much sense. Whatever is going to break RSA-2048 is likely to break all of RSA. The story we're commenting on is pretty clear that the motivation here is to streamline the logistics of moving to PQ cryptography.
Credible new systems aren't going to be developed with RSA, regardless.
SHA-1 is around long enough, that they build precomputation tables. NSA and other state-backed organizations have the capacity to do that. The community should at least up the ante to 256 bit to make things harder.
* https://articles.59.ca/doku.php?id=em:20482030
The document specifies that SHA-1 in HMACs is the be entirely disallowed after 2030. That seems like it would cause needless reimplementation of systems with the associated chance of security problems and expense. SHA-1 used in an HMAC is generally known to be secure.