I am targeting a security level of 128 bits for GnuPG, so I am using SHA-256 and AES-128. Now I need to choose between RSA-3072 and RSA-4096.
According to multiple sources RSA-3072 security level is very close to 128 bits. Based on this statement, choosing RSA-4096 over RSA-3072 makes no sense. Public keys are significantly bigger, signing/verifying speed is twice slower, and the extra security it adds is useless; digest and symmetric encryption algorithms are 128 bits secure after all.
The only issue I am aware of is a possible reduction on compatibility.
Do all GnuPG implementations (including hardware devices such as smart cards) that support RSA-4096 also support RSA-3072 too? Is it better to go with RSA-4096 for maximal compatibility or can I safely use RSA-3072?