What should be the size of a Diffie-Hellman private key? I'm implementing the SRP-6 protocol, which relies on discrete logarithms for it's security (essentially Diffie-Hellman).

The RFC documents state:


  The private values $a$ and $b$ SHOULD be at least 256-bit random numbers, to give
  approximately 128 bits of security against certain methods of calculating discrete
  logarithms.


I can't seem to find any info on this – is it still valid advice?

Is the reason for this simply that the best known method for calculating discrete logs of $n$-bit numbers requires $2^{n/2}$ steps?
Well, yes, that is generally good advice about DH.

Here is some background on this: support you were given a value $g^x \bmod p$, and you were also told that $1 \le x \le A$ for some value $A$.  If so, then there are several known attacks (such as Big Step/Little Step and Pollard's Rho) that can recover $x$ in about $\sqrt A$ steps.  If we have as our security goal that it should take at least $2^{128}$ steps, then means that $\sqrt A \ge 2^{128}$, or $A \ge 2^{256}$, that is, we take our private exponent $x$ to be a random 256 bit number (note: in this context, we count it as a 256 bit number even if the msbit happens to be zero).

Now, there are a few other notes I want to leave you with:


There isn't much point in making the private exponent much larger than that; there is another avenue (Number Field Sieve) which also can solve the Discrete Log problem in time which is independent of the size of the exponent, but only depends on the size of the modulus.  For realistic modulus sizes, this will also be around (or, at least, not significantly more than) $O(2^{128})$ steps, so making the private exponent significantly bigger will just make your computations more expensive, without making the system any more secure in any real sense.
One minor point about SRP (as opposed to straight DH); the protocol does leak the LSbit of the initiator's private exponent (by leak, I mean that someone listening to the messages being exchanged can deduce that bit value).  I don't believe that that's a big deal (as it's only 1 bit, and nothing else is leaked).  If you want to be pedantic, I suppose you could have the initiator pick a 257 big private exponent (so there will still be 256 unknown bits).