There have been comparisons between RSA and ECDH with regards to the number of qubits required to break the algorithm with a specific key size. But how many qubits are required to break "classical" Diffie-Hellman (DH) over a multiplicative (finite, cyclic) group?
This would for instance be interesting for stored DHE TLS sessions that used for key agreement. Would it do better or worse than RSA with a similar key size (and therefore, approximately the same classical cryptographic strength)?
