Question on RSA trapdoor permutation You plan to use a public-key cryptosystem based on the RSA trapdoor permutation in three different real-life applications, in which the attacker has, respectively, only one of the following resources:


a single computer, 
a collection of computers distributed across the Internet, and 
a quantum computer. 


When choosing the length of the modulus n for the RSA trapdoor permutation, you plan to choose a different length for each of the above three attacker resource scenarios. Which of the following length settings is closer to your choice?

A. (a): 1024; (b): 2048; (c): 4096  
B. (a): 512; (b): 1024; (c): I would not use RSA    
C. (a) 2048; (b): 4096; (c): I would not use RSA    
D. (a) 512; (b): 1024; (c): 2048


Not sure how to do this. Can anyone help me with this and explain why?
My own answer would be: 2048, 2048, and still 2048 bits.

Why ? Because:


2048-bit is the current "standard recommendation"; it has been so for quite some time, and is likely to remain so for quite some time (decades). See this site for pointers.
There are plans for removing support for keys shorter than 2048 bits in some widespread software, e.g. Firefox. Using shorter keys invites future interoperability trouble and maintenance headaches.
There are widespread systems (in particular hardware, such as smart cards and HSM) which have trouble with keys larger than 2048 bits. Even when longer keys are supported, the computational cost rises quite sharply with the key size, so you don't want to overdo it (if your algorithm is super-secure but too heavy, then people will look for ways not to use it, and so goes security down the drain).
If your enemy has access to a quantum computer, then he has resources which are way beyond your wildest dreams. Remember that hiring a few thugs to break your kneecaps is cheap; an attacker with a budget of more than 10k$ will just do that, instead of trying to unravel your public key with computers. Then an attacker who can afford a machine that does not seem to exist at all... Contrary to a quantum computer, a tiny camera concealed in your own glasses is doable with existing technology, and will reveal all your secrets. Worrying about quantum computers is therefore misdirected paranoia.


Your examiner would probably dislike this answer, though. He probably expects that you answer "don't use RSA" when the attacker has a quantum computer, so that you show that you have understood that a quantum computer will make short work of RSA keys of any size.