check DH key lengths to avoid downgrade attack