Support for >4096 bit keys

Try openssl speed rsa; you might get results like

                  sign    verify    sign/s verify/s
rsa  512 bits 0.000055s 0.000004s  18222.2 232715.6
rsa 1024 bits 0.000160s 0.000011s   6234.6  91809.1
rsa 2048 bits 0.001122s 0.000033s    891.6  30691.3
rsa 4096 bits 0.007710s 0.000119s    129.7   8403.1

I don’t see a way to make it test with 8192-bit moduli without recompiling, but here each modulus size doubling appeared to increase the time per operation by a factor of about 3×-7×. So, it’s a significant performance impact.

I agree with @_az’s point that the CA certificate having a 2048-bit modulus makes that a weaker link, and since the CA certificate is much longer-lived than an end-entity certificate, it’s also a much more valuable target for attacks. (Although on that ground we could have argued against supporting 4096-bit keys for end-entity certs.)

I don’t think there is much expert guidance recommending use of >4096-bit RSA. There is the super-mysterious anti-ECC guidance from NSA, but they also don’t call for longer RSA keylengths.