Add more workfactor estimate helpers.

Specifically a named one for integer factorization (despite using same
formula as DL calc) which incorporates the k value from RFC 3766. Also
adds dl_exponent_size which returns the exponent size, this one ignores
k thus using a ~10 bit larger exponent than strictly necessary.

Adding in k downgrades 1024 bit RSA to exactly 80 bits, which is probably
about right.

1 files changed, 1 insertions, 1 deletions

diff --git a/src/lib/pubkey/dl_group/dl_group.cpp b/src/lib/pubkey/dl_group/dl_group.cpp
index fbaa67eaa..8e9c35f2a 100644
--- a/src/lib/pubkey/dl_group/dl_group.cpp
+++ b/src/lib/pubkey/dl_group/dl_group.cpp
@@ -55,7 +55,7 @@ DL_Group::DL_Group(RandomNumberGenerator& rng,
    else if(type == Prime_Subgroup)
       {
       if(!qbits)
-         qbits = 2 * dl_work_factor(pbits);
+         qbits = dl_exponent_size(pbits);
 
       q = random_prime(rng, qbits);
       BigInt X;