Following up on my previous post, I thought I might get a more concrete answer if I gave a more concrete question.
I require 128-bit security so I choose a 3072-bit RSA modulus ($\ell_n=3072$). Specifically I choose $n=pq=(2p'+1)(2q'+1)$ that is a product of safe primes $p$ and $q$.
Now, I want to choose $\ell_\Lambda$ such that finding DL with $\ell_\Lambda$-bit exponents is hard in $QR_n$, for an adversary who does not know the factorization of $n$, with 128 bits of security.
Note that the order of $QR_n=\phi(n)/4=p'q'$, so each element has large order.
Is choosing $\ell_\Lambda=256$ sufficient as suggested in the answer to my previous post?