I’m pretty sure that certain three letter agencies are using this kind of attack.
It wasn’t clear to me that this conclusion is warranted i.e. it depends on whether “our database” includes all public keys on the planet, all public keys in use specifically with ProtonMail, or something in between.
The overall topic is a bit beyond my level of knowledge but I think the conclusions are:
- 2048 bits is not enough (use minimum 3072)
- when generating secret keys (symmetric or asymmetric) do make sure that you have enough entropy - I use external hardware to supplement entropy
- specifically for SSH (not directly relevant to that paper, I think) use ECDSA rather than older choices (which by now is the default anyway, I think) - more generally, keep software current and keep abreast of developments in crypto