Re: speaking of keys

["The Purple Streak, Hilarie Orman" <ho@alum.mit.edu>]

The security of a 1024-bit DH is too small for my comfort (that of a
reasonable paranoid) for a single key exchange.  I.e., I want my
asymmetric keys to have more than 90 bits of strength and would
recommend this policy to others.

Further, knowing that ALL keys exchanged for IPSec would be protected
by only this single mechanism, I want the computational cost for the
discrete log attacker to be quite a bit higher, probably proportional
to something like the number of keys expected to be exchanged for the
next 20 years.  That depends on how successful IPSec key exhange will
be.  Bet on success, assume Moore's Law falters somewhat, and add 20
bits.  Altogether that totals at least 110 bits of strength and that's
a modulus size of around 2048.

Hilarie