Ular RSA modulus sizes are 1024, 2048, 3072 and 4092 bits. How many random odd integers do we have to test on average until we expect to find one that is a prime

In RSA, the bit size n of the public modulus N is often of the form n=c⋅2k with c a small odd integer. c=1 (n=512, 1024, 2048, 4096.. bit) is most common, but c=3 (n=768, 1536, 3072.. bit) and c=5 (n=1280..) are common. One reason for this is simply to limit the number of possibilities, and similar progressions are found everywhere in cryptography, and often in computers where binary rules (e.g. size of RAM).

The difficulty of factoring (thus, as far as we know, the security of RSA in the absence of side-channel and padding attacks) grows smoothly with n. But the difficulty of computing the RSA public and private functions grows largely stepwise as n increases (more on why in the next paragraph). The values of n just below a step is thus more attractive than the value just above a step: they are about as secure, but the later is more difficult/slow in actual use. And, not coincidentally, the common RSA modulus sizes are just below such steps.

One major factor creating a step is when one more word/storage unit becomes required to store a number. When the storage unit is b-bit, there is such step every b bits for the RSA public function x↦xemodN; and a step every r⋅b bits for the RSA private function x↦xdmodN, with r=1 for the naïve implementation, and r equal to the number of factors of N when using the CRT with factors of equal bit size (most usually r=2, but I have heard of plans up to r=8). On any modern general-purpose CPU suitable for RSA, b is a power of two and at the very least 25, creating a strong incentive that n is at least a multiple of 26 (r=2 is common, and the only reasonable choice for n below about a thousand).

Note: n=1984=31⋅26 is not unseen in the field of Smart Cards, because the next multiple of 26 would break the equivalent of a sound barrier in a common transport protocol, ISO/IEC 7816-3 T=0. For a list of common RSA modulus size in this field, search LENGTH_RSA_1984.

As an aside, it is significantly simpler to code quotient estimation in Euclidian division (something much used in RSA) when the number of bits of the divisor is known in advance. This creates an incentive to reduce the number of possible bit sizes for the modulus. The two simplest cases are when the number of bits is a multiple of b, and one more than a multiple of b; the former won.