I've been asked to enable DHE in our SMTP product. I'm stuck on this question:
How often should the product regenerate its DHE p and g parameters?
I've seen some implementations that use a cron job to regenerate p and g once per day; others (e.g., Postfix) set p and g as source code constants. The most common approach seems to be once at install time.
If I understand it correctly, even if p and g are known to an attacker, recovering the encryption key means solving the discrete logarithm problem. From that I would infer that generating p and g at install time is more than adequate. But I also saw media reports about a year ago suggesting that the discrete logarithm problem might be solved by the end of the decade; that would suggest regenerating p and g regularly might be prudent.