Requirement for the exponent generation during DH protocol

Question

The setting is classic DH protocol. Alice computes $A = g^a \bmod p$. Alice then sends $A$ to Bob. Then Bob will send $B = g^b \bmod p$ to Alice.

Are there any requirements for the values $a$ and $b$ besides they should be greater than $1$?

score 1 · Accepted Answer · edited Apr 13 '17 at 12:48

1

Since $g$, $A=g^a$ and $B=g^b$ are made public, everyone could repeat the same operation and brute force DH with small exponents.

Summary: considering a security level of $n$, it is advised to use exponents of at least $2n$ bits.

edited Apr 13 '17 at 12:48

Community

answered Feb 15 '15 at 07:21

Pierre

1 Answers1