As I understand it, bruteforcing a Diffie-Hellman generated secret key takes $P-1$ attempts to crack the shared secret, where $P$ is a very large prime used for modulus. If your $P$ is quite large, ...
Why are the random exponents so much bigger in the Socialist Millionaire protocol versus Diffie-Hellman key exchange?
Section 8, Security considerations, of RFC3526, which defines groups used for Diffie-Hellman has a table recommending some random exponent sizes. In particular, it says: The strength of a key ...