Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I was wondering if a group like the 1536-bit MODP Group from RFC 3526 was a Schnorr group?

A Schnorr group must apparently have:

  • $p$ and $q$ being primes
  • $p = q\cdot r+1$
  • $1 < h < p$
  • $h^r\not\equiv 1\pmod p$

And then $g = h^r\bmod p$ is the generator.

In RFC3526's 1536-bit MODP, there's a prime: $$2^{1536}-2^{1472}-1+2^{64}\cdot\lfloor2^{1406}\cdot\text{pi}+741804\rfloor$$ (not too sure what $\text{pi}$ is here)
and the generator is $g=2$.

My question is if such a group is a Schnorr group or not?

If it's a Schnorr group, what are the values or $p$, $q$, $r$ and $h$?

References:
RFC3526 MODP Diffie-Hellman groups for IKE
en.wikipedia.org/wiki/Schnorr_group

share|improve this question
    
I'd guess these are safe primes, so $r=2$, for Schnorr groups we generally select a much smaller $q$, only twice the security level. –  CodesInChaos Apr 25 at 15:12
add comment

1 Answer 1

up vote 3 down vote accepted

Yes, it meets the formal definition of a Schnorr group; however it was constructed somewhat differently. Normally, when we generate a Schnorr group, we pick a prime $q$, and then search for an $r$ so that $qr+1$ is also prime; with the RFC3526 group, they picked $p$ and $q$ simultaneously. In addition, when it came to selecting the generator, they did not select the value $h$ and compute $g$ from that. Instead, they selected $p$ such that $g=2$ generated a prime subgroup.

As for the values you asked about:

$$p = 2^{1536} - 2^{1472} - 1 + 2^{64} * \lfloor 2^{1406} \pi + 741804 \rfloor$$

(and yes, $pi = \pi$ is everyone's favorite transcendental number)

$$q = (p-1)/2$$

$$r = 2$$

$$h = 2^{(p+1)/4} \bmod p$$

We have this rather odd looking $h$ because that makes $h^r \equiv 2$. Since Schnorr groups had no restriction on what $h$ is (other than $h^r \not\equiv 1$), this satisfies the definition.

share|improve this answer
    
thanks, this really helps me a lot... I thought it was a Schnorr group, but I couldn't understand how the generator could possibly be 2. –  Cedric Martin Apr 25 at 16:38
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.