# How large should a Diffie-Hellman p be if the messages are encrypted?

How large should the prime $p$ and generator $g$ values be in a Diffie-Hellman handshake if the messages are encrypted.

If the key that encrypted the Diffie-Hellman messages becomes compromised, then does that compromise the key generated using Diffie-Hellman?

-
Messages being encrypted doesn't make a difference. Just use a standard group designed for diffie-hellman. – CodesInChaos Mar 18 '13 at 8:03
You should also ask yourself what you're using DH for, if you already have a shared key? Forward secrecy? – CodesInChaos Mar 18 '13 at 8:03
Forward secrecy is one reason, but also it is commonly used in password protocols as well, where the key is the password. – jaye1234 Mar 18 '13 at 8:20

How large should $p$ be if the Diffie-Hellman exchange is encrypted? Well, that rather depends on:

• How much do you trust the encryption key not to be recovered?

• Why are you doing a Diffie-Hellman in the first place?

If you can trust that the encryption key will never be recovered by anyone other than the sender and the receiver, then it doesn't really matter how large of a Diffie-Hellman modulus you use. On the other hand, you don't need to do Diffie-Hellman at all, you could have one side pick a random value, and send that, encrypted by the key that we trust.

However, if you can't assume that the encryption key may not be compromised, then it would appear that you would have the same requirements on the DH parameters that we have on unencrypted exchanges; which (with the current hardware and DLOG algorithms) is that $p$ be at least 1024 bits, and that $g$ has an order that's a prime at least 256 bits long.

BTW: you asked about the size of $g$; its actual size isn't important. What's important is its order, that is, the smallest $x>0$ for which $g^x = 1 \bmod p$. This order $x$ should be a large prime value. Small values of $g$ can achieve this; in particular, if $(p-1)/2$ is also prime and $p = 7 \bmod 8$, then $g=2$ will always have a large prime order (and, in fact, in such a modulus, you can show that if someone can solve the computational DH problem with $g=2$, then they can solve it in that modulus for any value of $g$ with a polynomial number of queries).