I've noticed that websites start to use 256-bit symmetric encryption, but often still end up using 2048-bit RSA keys.
The link above displays the ECRYPT II recommendations, which state that 128-bit symmetric and 3248-bit asymmetric encryption have a compareable strength.
The NIST recommendations state that 128-bit symmetric is comparable to 3072-bit asymmetric encryption.
This would mean that 2048-bit RSA is weaker than 128-bit symmetric encryption. Which makes me wonder why websites are starting to offer 256-bit symmetric encryption while the weakest link (RSA) doesn't even offer 128-bit strength.
Is there anything I'm missing here?