Why the size of a DH prime $p$ should be about 6800 bits long to force an attacker to perform $2^{128}$ steps to attack the system?
How is this relationship 6800-128 established?
Why the size of a DH prime $p$ should be about 6800 bits long to force an attacker to perform $2^{128}$ steps to attack the system?
How is this relationship 6800-128 established?
How do we pick a group size for a 128-bit security level?
In this case, for appropriately selected groups, without back doors, like the RFC 3526 groups, the best attack algorithm is the general number field sieve, GNFS. The usual (single-target) cost estimate for the GNFS is $L^{\sqrt[3]{64/9} + o(1)} \approx L^{1.92999 + o(1)}$ where $L = e^{(\log p)^{1/3} (\log \log p)^{2/3}}$ and $p$ is the modulus. Where 6800 came from is unclear to me; the usual consensus is that 3072 is plenty for a 128-bit security level, even if the $\sqrt[3]{64/9}$ figure is optimistic. Of course, you can get much better performance, and much better implementation security, if you use X25519 instead.