> Ideally the DH group would match or exceed the RSA key size but 1024-bit DHE is arguably better than straight 2048-bit RSA So let's argue! It depends on how

> Ideally the DH group would match or exceed the RSA key size but 1024-bit DHE is arguably better than straight 2048-bit RSA So let's argue! It depends on how you presume the attacker is gonna get you. Suppose the attacker is well-funded enough to go after one RSA-1024 or DH-1024 instance. Unlike RSA, however, DHE tends to work modulo the same prime over and over. This has consequences for cryptanalysis: once the attacker has solved a single DH instance, they can solve the next one much faster [2]. In the case of 1024-bit DH, the subsequent instances can be solved in about 2^55 time (versus about 2^80 for the first log); this is not instant, but it's pretty quick for a well-funded and skilled attacker. Where 1024-bit DHE does shine versus 2048-bit static RSA is against other, less Hollywood, types of key retrieval such as outright hacking. [1] https://tools.ietf.org/html/rfc2409#page-22 https://tools.ietf.org/html/rfc2409#page-22 [2] http://www.iacr.org/archive/pkc2006/39580175/39580175.pdf http://www.iacr.org/archive/pkc2006/39580175/39580175.pdf