# Requirement for the exponent generation during DH protocol [duplicate]

This question already has an answer here:

The setting is classic DH protocol. Alice computes $A = g^a \bmod p$. Alice then sends $A$ to Bob. Then Bob will send $B = g^b \bmod p$ to Alice.

Are there any requirements for the values $a$ and $b$ besides they should be greater than $1$?

## marked as duplicate by yyyyyyy, DrLecter, e-sushi, poncho, SethFeb 15 '15 at 20:51

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

## 1 Answer

Since $g$, $A=g^a$ and $B=g^b$ are made public, everyone could repeat the same operation and brute force DH with small exponents.

There are already many responses:
link to security.stackexchange.com
link to crypto.stackexchange.com

Summary: considering a security level of $n$, it is advised to use exponents of at least $2n$ bits.