<i>Don&#x27;t use out-of-the-box Diffie Hellman params</i><p>Wrong answer.  Standard primes are fine; just avoid the small ones.  If you try to select your own parameters you&#x27;re probably going to pick wrong, either in the sense of breaking the crypto or making people wonder if you selected your parameters to hide a backdoor.  The standard large primes (my preferred option is the &quot;group #14&quot; 2048-bit prime) were very obviously not selected maliciously, and there&#x27;s no way anyone has done the precomputations necessary to index <i>that</i> group.