diff --git a/lib/modules/SSL.pmod/Cipher.pmod b/lib/modules/SSL.pmod/Cipher.pmod
index 727a550d160649421d187b031e8044c2caaee44c..0cabecc2e97bda52a429d7203ba9ffd88d6fc8b6 100644
--- a/lib/modules/SSL.pmod/Cipher.pmod
+++ b/lib/modules/SSL.pmod/Cipher.pmod
@@ -711,8 +711,33 @@ class KeyExchangeDHE
     anonymous = 1;
     struct = ADT.struct();
 
-    // Default to using MODP Group 24 (2048/256 bits).
-    dh_state = .Cipher.DHKeyExchange(Crypto.DH.MODPGroup24);
+    // NIST SP800-57 5.6.1
+    // { symmetric key length, p limit, q limit }
+    constant nist_strength = ({
+      ({ 80,   1024, 160 }),
+      ({ 112,  2048, 224 }),
+      ({ 128,  3072, 256 }),
+      ({ 192,  7680, 384 }),
+      ({ 256, 15360, 511 }),
+    });
+    int key_strength = CIPHER_effective_keylengths
+      [ CIPHER_SUITES[ session->cipher_suite ][1] ];
+    int target_p, target_q;
+    foreach(nist_strength, [int key, target_p, target_q])
+      if( key_strength <= key ) break;
+
+    Crypto.DH.Parameters p;
+    foreach( context->dh_groups, Crypto.DH.Parameters o )
+    {
+      if( !p || o->p->size()>p->p->size() ||
+          (o->p->size()==p->p->size() && o->q->size()>p->q->size()) )
+        p = o;
+      if( p->p->size() >= target_p && p->q->size() >= target_q )
+        break;
+    }
+
+    if(!p) error("No suitable DH group in Context.\n");
+    dh_state = DHKeyExchange(p);
     dh_state->new_secret(context->random);
 
     struct->put_bignum(dh_state->parameters->p);
diff --git a/lib/modules/SSL.pmod/Context.pike b/lib/modules/SSL.pmod/Context.pike
index dd762f78848f3958fa61d196ca1e9c879be1f2cd..8671736b659602e0f9d0fa508bb59d6df94a79b8 100644
--- a/lib/modules/SSL.pmod/Context.pike
+++ b/lib/modules/SSL.pmod/Context.pike
@@ -164,6 +164,14 @@ array(int) preferred_suites;
 //! Supported elliptical curve cipher curves in order of preference.
 array(int) ecc_curves = reverse(sort(indices(ECC_CURVES)));
 
+//! Supported DH groups for DHE key exchanges, in order of preference.
+//! Defaults to MODP Group 24 (2048/256 bits) from RFC 5114 section
+//! 2.3.
+array(Crypto.DH.Parameters) dh_groups = ({
+  Crypto.DH.MODPGroup24, // MODP Group 24 (2048/256 bits).
+});
+
+
 //! The set of <hash, signature> combinations to use by us.
 //!
 //! Only used with TLS 1.2 and later.