>> You can get 64-bits of strength by dispersing 19 bits at random in 1024. >> This makes one part of the DH computation very fast, but it slows down the >> other substantially. > > Which half? I'm only concerned about the speed of shared-secret > generation, not public key computation (precomputed in background). It's the shared secret part that gets slower -- QED by Murphy's :-)