My system uses AES-256, 4096bit RSA CA key and 2048bit RSA keys for servers together with SHA-256 signing.

Does using 1024bit DH key exchange lower its security?

I read on one mailing list that 1024bit DH provides about 70-80bits of security, is it true?

2 Answers 2


Comparing key strength between symmetric encryption and asymmetric key exchange is like comparing apples with oranges: it is doable (they are both tasty fruits) but tricky and full of subtle details. To break DH, the best known method is trying to solve the discrete logarithm problem, for which the best known algorithm is a variant of Index Calculus which contains parts of the General Number Field Sieve algorithm (GNFS is for factorization, but discrete logarithm modulo a prime, and factorization of a big non-prime integer, are mathematically related problems). Such attack algorithms require quite a lot of horsepower, in particular lots of very fast RAM; on the other hand, breaking a symmetric key through exhaustive search (that's what we mean by "n bits of security") requires only CPU, but no RAM, and is much more easily distributed over many nodes. So the apples are CPU and the oranges are RAM. The really only common measure for both is the dollar; but asking the financial cost of breaking a 1024-bit DH key, or the financial cost of breaking an 80-bit symmetric key, is kind of meaningless, since this goes into amounts where the dollar ceases to be well-defined (as an order of magnitude, dollars can be used to measure amounts up to the US national debt, but not much higher).

These caveats did not prevent various researchers and standardization organisms from making apple/orange comparisons. This site makes a good job of listing those security estimates, with handy online calculators. As a baseline, they about all agree that 1024-bit DH is close, in security, to what a 77 to 80-bit symmetric key offers. Note that a 64-bit symmetric key was broken in 2002, and 77-bit is "only" 8192 times more difficult.

Since the best known discrete logarithm attack (IC with GNFS) has many common parts with the best known factorization algorithm (GNFS), DH with a k-bit modulus should be roughly equivalent to a RSA key with a k-bit modulus. So you should use 2048 bits for DH too.

In your list, "AES-256" is overkill (AES-128 would still be "more secure" than 2048-bit RSA or DH), but mostly harmless overkill (AES-256 is only 40% slower than AES-128).

  • +1 if only for explaining the difference between apples and oranges. And yes, I know that AES 256 is overkill, but it's the easiest dial to turn up to 11 -- without performance and compatibility problems. Jul 20, 2011 at 18:16
  • 2
    This answer is quite some years old. In the mean time a paper was published that explains that the cost to break a DH 1024 prime is 'just' a few hundred million dollars upfront and one year per prime. See: freedom-to-tinker.com/blog/haldermanheninger/… Oct 15, 2015 at 12:14

A good rule of thumb is to match your DH key sizes with your RSA key sizes, so 2048 is a good minimum to use in 2011.

  • 5
    Why is it a good rule of thumb? Do you have any references?
    – this.josh
    Jul 20, 2011 at 17:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .