Concur with everything Tom Leek said, but a few more points to consider:


recent mod_ssl does support DH parameters larger than 1024 and older ones can be patched: http://blog.ivanristic.com/2013/08/increasing-dhe-strength-on-apache.html (updated)
if you need (or want) to follow US government requirements, NIST Special Pub 800-57 (at csrc.nist.gov) as of last month requires minimum 2048 for integer-based algorithms RSA, DSA and DH (versus 224 ECC, and hash and 112 symmetric).
if you (may) have Java clients, the (very common) Suncle Java, and I believe also (closely linked) OpenJDK, through current 7, does not handle DH over 1024 bits. To be exact, it implements original DSA (FIPS 186-0) sizes of P 512 to 1024 by 64 and Q 160, not the FIPS 186-3 improvements 2048/224,256 and 3072/256, and for no good reason imposes the same limits on DH. I've seen a bugs.java.com entry that says this will be fixed in Java 8, but google doesn't find it. See also http://stackoverflow.com/questions/6851461/java-why-does-ssl-handshake-give-could-not-generate-dh-keypair-exception
OTOH Suncle Java 7 (and 6 if you add an ECC provider) does implement ECDH right and by default gives ECDHE suites preference over DHE, so if your server supports both DH-2048 and ECDH-reasonable, it's okay. (For web clients in general ECDH P-256 seems best.)


1024-bit DHE vs 2048-bit RSA
Hi,

I have a question that I've been thinking about for a long time.

How can you assure yourself that you've fully comprehended a concept or the true meaning of a theorem in mathematics?

I mean how can you realize that you totally get the concept and it's time to move on to the next pages of the book you're reading?

Thanks in advance for your responses.
