> which means that a single DH exponentiation would take even more than > 15 seconds. One can use elliptic curves and a F[2^n] field (where n = 155, e.g.) to cut down the time by at least a factor of 3. This is the method described some years ago by Neil Koblitz (and not the one patented by NeXT).