# Safe generator for ElGamal signature

What are the properties a generator $g$ should have to be secure for ElGamal signatures (original scheme)?

I am aware that it is poorly chosen and not secure when $g|p-1$ or $g^{-1}|p-1$, where $p$ is the large prime so that $g$ generates $Z_p^*$ and $g$ has maximum order (that is, $p-1$).

Are there other properties one should consider? Additionally, should $g$ be picked randomly over $[1..p-1]$ or is it safe to choose it to be a small integer to start with?

-

First you should know that Elgamal encryption and signature security is based on DDH problem (Decisional Diffie Hellman) which is tractable in some groups that CDH problem is believed to be hard (Computational Diffie Hellman). As in the case of $\mathbb{Z_q}$ in which CDH is believed to be hard but DDH is apparently tractable.
Let $p = 2p_1 + 1$ where both $p$ and $p_1$ are prime. Let $Q_p$ be the subgroup of quadratic residues in $\mathbb{Z_p}$. $Q_p$ is a cyclic group of prime order itself in which DDH assumption is believed to be hard. This group and some other groups in which DDH problem is intractable are mentioned in this paper by Dan Boneh.
Any randomly chosen primitive element in $\mathbb{Z_p}$, say $g$, to the power of two ($g_1=g^2$) is a 'safe' generator for the subgroup of quadratic residues in $\mathbb{Z_p}$ (it is defined above as $Q_p$). A primitive element of $\mathbb{Z_q}$ is an element which are relatively prime to $p$. ($gcd(g,p)=1$)