Section 8, Security considerations, of RFC3526, which defines groups used for Diffie-Hellman has a table recommending some random exponent sizes. In particular, it says:
- The strength of a key exchanged using the 1536 bit group has
- about 90 bits strength for a 180 bit random exponent
- about 120 bits of strength for a 240 bit random exponent
On the other hand, the Off-the-Record protocol spec, which uses that 1536 bit DH group, says:
The random exponents are 1536-bit numbers.
I'm not adhering to the OTR spec, because I'm just using the SMP part of it. But I'm interested to find out:
What is the reason to use these comparatively huge random exponents, when a DH key exchange gets what I would call "enough" strength at far lower exponent sizes? I'm interested because 240 bit random numbers make the authentication go a lot quicker.
As a bonus: how does SMP using the 2048, or 4096 bit groups with smaller random exponents compare to using the 1536 bit group with large random exponents?