Should I get rid of my very old 1024-bit RSA ssh key?


I have an RSA key I use for ssh between various accounts that was originally generated in 2002 — hence it has the then-standard 1024 bits. Is there any point to deleting that key from all my machines and regenerating a new (and presumably somewhat more secure) one?

Most of the responses to this similar but older question relate to worries about specific compromises and note the lack of “key-wear”. However, this isn’t strictly true, since shorter keys do become easier to attack over time — my 1024-bit RSA key is notably weaker than currently-preferred sizes of 2048 or 4096 (although I believe it’s the case that it still isn’t thought to have been broken by publicly known attacks). Should I be worried now, in 2020 or, really, anytime in the foreseeable (non-quantum!) future, worried enough to retire the old key entirely? Or, realistically, is my key plenty safe in practice? (Again, I’m not asking about other aspects of key security, but purely about the age and size of the key itself.)

(There’s another, also related and old, question here, but it’s not limited to just ssh, and is more descriptive than prescriptive.)