I'm using TLS with a Diffie-Hellman key exchange to negotiate the symmetric keys. How long should the exponents be?

  • $\begingroup$ Which key-exchange are you talking about? DHE? $\endgroup$ Jun 26, 2013 at 6:42
  • $\begingroup$ Yes, Diffie Hellman. $\endgroup$ Jun 26, 2013 at 15:42

1 Answer 1


Diffie-Hellman exponents need at a size at least twice the security level.

So for elliptic curve DH you need the same size as the underlying field. For example 256 bits for P-256.

For finite-field DH you still need twice the security level as exponent, but significantly larger fields. For example for an 80 bit level you need 160 bit exponents and a ~1024 bit field.


Not the answer you're looking for? Browse other questions tagged or ask your own question.