It turns out that verifying whether a given prime is appropriate for Diffie-Hellman is rather slow.  This means that, if you accept a prime supplied by someone else (e.g. whoever you&#x27;re communicating with), and you don&#x27;t carefully verify the prime, then you&#x27;re at risk of ending up with a maliciously chosen weak group and&#x2F;or generator.<p>For some protocols, this is fine.  For other protocols, it&#x27;s a problem.  IIRC one variant of the triple-handshake attach on TLS involved tricking the client into using a weak group.<p>From memory (too lazy to look up all the details right now), the issue is that the order of the multiplicative group mod p is p-1.  If p is a prime greater than 3 (which it is in standard Diffie-Hellman), then p-1 is certainly not prime, which means that the multiplicative group will have subgroups of varying sizes.  Some subgroups might be small.  If one party sends a public share in a small subgroup, then bad things can happen.<p>Unfortunately, validating the DH parameters is too slow to do with each handshake.  So either you carefully design the protocol to avoid this problem (which is certainly doable in many case), you use a well-known group (which should be fine as long as the group is large enough), or you use something like ECDH.  ECDH is nice because the index calculus attacks don&#x27;t work and you can have a nice group structure.<p>Aside: While it&#x27;s possible for an EC group to have a prime order, for various tricky reasons, the better modern EC curves deliberately have an order that&#x27;s h*p for some small h (h is called the &quot;cofactor&quot; and h=4 or h=8 are common) and a large prime p.  This gives some nifty benefits, but it requires a bit of care under some circumstances.