@nprofile1q... I read your old post on key sizes, unfortunately still relevant: https://blog.cr.yp.to/20151120-batchattacks.html

I noted two points that it probably should mention, but doesn't:

1. That the issue also apply to random number generators, all cryptographic algorithms are vulnerable if their key stems from an RNG with 128 bits of state.

2. That mitigation is free. For most symmetric algorithms a change that increases key/state size does not have to increase computation.