The RSA Frequently Asked Questions document by RSA Data Security, Inc., 1995. It is generally considered to be secure when sufficiently long keys and proper generators are used. Diffie-Hellman is claimed to be patented in the United States, but the patent expires April 29, 1997. Diffie-Hellman is sensitive to the choice of the strong prime and the generator. The size of the secret exponent is also important for its security.
Conservative advice is to make the random exponent twice as long as the intended session key.
Basically, they conclude that by doing precomputations, it is possible to compute discrete logarithms relative to a particular prime efficiently. The work needed for the precomputation is approximately equal or slightly higher than the work needed for factoring a composite number of the same size. In practice this means that if the same prime is used for a large number of exchanges, it should be larger than 512 bits in size, preferably 1024 bits. There is also a new timing attack that can be used to break many implementations of Diffie-Hellman. Many implementations of Diffie-Hellman are freely available.