We don't, in the same way that we don't know there aren't vulnerabilities in the quantum protocol they're using, or in its practical implementation. And if the

We don't, in the same way that we don't know there aren't vulnerabilities in the quantum protocol they're using, or in its practical implementation. And if the NSA can only break DHE for parameters less than N bits, why not just use a ridiculously high number like 10000 bits, since it's only a linear cost when you know the key.