For FFDH exponents follow the guidance of NIST SP 800-56A and 800-56B

[randombit]

For many common group sizes this results in using a slightly smaller exponent and thus faster computation

Group Size	Old Exponent Size	NIST SP 800-56A Exponent
2048	256	224
3072	384	256
4096	384	304
6144	512	352
8192	512	400

cc @reneme since possibly BSI has opinions on this, though I would hope it more or less matches up with NIST

[Copilot]

Pull request overview

Updates Botan’s discrete-log exponent sizing to follow NIST guidance for common FFDHE/DL group sizes (typically selecting smaller exponents for improved performance), and refreshes test vectors accordingly.

Changes:

• Adjust dl_exponent_size() thresholds (e.g., 2048→224 bits, 3072→256 bits, 4096→304 bits, etc.).
• Update public-key workfactor test vectors to match the new exponent sizing rules, including boundary/step cases.
• Regenerate TLS KeyShare extension test vectors that depend on FFDHE exponent generation.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
src/lib/pubkey/workfactor.cpp	Implements new piecewise exponent-size mapping and adds input validation/comments.
src/tests/data/pubkey/workfactor.vec	Updates expected exponent sizes and adds cases around new thresholds.
src/tests/data/tls_extensions/generation/key_share_CH_offers.vec	Updates KeyShare serialized outputs and RNG pools due to changed FFDHE exponent lengths.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[reneme]

cc @reneme since possibly BSI has opinions on this, though I would hope it more or less matches up with NIST

I take the liberty to pass this question on to @falko-strenzke :)

[coveralls]

coverage: 90.335% (+0.001%) from 90.334%
when pulling 03a6a77 on jack/dl-exp-sp-800-56a
into af19f62 on master.

[falko-strenzke]

@randombit
Comparing it with the requirements in BSI TR 02102, the parameters look OK, since BSI requires prime ≥ 3000 and exponent ≥ 250. This is fulfilled for by the table. So I think it should be fine.