# Are the RFC3526 MODP groups Schnorr groups?

I was wondering if a group like the 1536-bit MODP Group from RFC 3526 was a Schnorr group?

A Schnorr group must apparently have:

• $p$ and $q$ being primes
• $p = q\cdot r+1$
• $1 < h < p$
• $h^r\not\equiv 1\pmod p$

And then $g = h^r\bmod p$ is the generator.

In RFC3526's 1536-bit MODP, there's a prime: $$2^{1536}-2^{1472}-1+2^{64}\cdot\lfloor2^{1406}\cdot\text{pi}+741804\rfloor$$ (not too sure what $\text{pi}$ is here)
and the generator is $g=2$.

My question is if such a group is a Schnorr group or not?

If it's a Schnorr group, what are the values or $p$, $q$, $r$ and $h$?

-
I'd guess these are safe primes, so $r=2$, for Schnorr groups we generally select a much smaller $q$, only twice the security level. – CodesInChaos Apr 25 '14 at 15:12

Yes, it meets the formal definition of a Schnorr group; however it was constructed somewhat differently. Normally, when we generate a Schnorr group, we pick a prime $q$, and then search for an $r$ so that $qr+1$ is also prime; with the RFC3526 group, they picked $p$ and $q$ simultaneously. In addition, when it came to selecting the generator, they did not select the value $h$ and compute $g$ from that. Instead, they selected $p$ such that $g=2$ generated a prime subgroup.

$$p = 2^{1536} - 2^{1472} - 1 + 2^{64} * \lfloor 2^{1406} \pi + 741804 \rfloor$$

(and yes, $pi = \pi$ is everyone's favorite transcendental number)

$$q = (p-1)/2$$

$$r = 2$$

$$h = 2^{(p+1)/4} \bmod p$$

We have this rather odd looking $h$ because that makes $h^r \equiv 2$. Since Schnorr groups had no restriction on what $h$ is (other than $h^r \not\equiv 1$), this satisfies the definition.

-
thanks, this really helps me a lot... I thought it was a Schnorr group, but I couldn't understand how the generator could possibly be 2. – Cedric Martin Apr 25 '14 at 16:38