The setting is classic DH protocol. Alice computes $A = g^a \bmod p$. Alice then sends $A$ to Bob. Then Bob will send $B = g^b \bmod p$ to Alice.

Are there any requirements for the values $a$ and $b$ besides they should be greater than $1$?


Since $g$, $A=g^a$ and $B=g^b$ are made public, everyone could repeat the same operation and brute force DH with small exponents.

There are already many responses:
link to security.stackexchange.com
link to crypto.stackexchange.com

Summary: considering a security level of $n$, it is advised to use exponents of at least $2n$ bits.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.