# Tag Info

2

One requirement that you don't have listed is that the generator $g$ needs to generate a subgroup that's of a large prime order; here's what can go wrong if that is not true: If the order of $g$ (which we call $q$) has a factor $r$, then the attacker can, hearing $g^x$, determine $x \bmod r$ in $O(\sqrt{r})$ time. If $r$ isn't large, this immediately ...

1

One consideration might be to generate a group so that the prime modulo p can be written in the form: $$p = 2q +1$$ Where $q$ is prime. Since every subgroup of $Z_p$ has order $a$ such that $a|p-1$ the only possible subgroups of this group have order either 2 or $q$. Then you can use a generator for the subgroup of order $q$.

Only top voted, non community-wiki answers of a minimum length are eligible