Ik like this taken on it. But the math isnt complete. You need to account for each attack path taken.

For example: a generic SSH vulnerability means somebody is going to make a botnet to check every port 22, leaving your 1024 bits useless and the 16 bits worth more.