(EC)?DH security level as function of key size

[lvh]

The current version of the book cites RSA Labs which talks about relative required key sizes for the RSA problem (solved with GNFS) versus an elliptic curve variant (solved using some unnamed sqrt(n) algorithm). We're using this for DH, even though it's obviously not about DH. There's a footnote clarifying that EC vs classic DH has a similar work factor, but it'd be cool if we had a real citation for this instead of just a handwave.

[lvh]

The eCRYPT document on key size recommendations might be useful (and, indeed, useful in general!)

http://www.ecrypt.eu.org/documents/D.SPA.20.pdf