can't we do a nobus backdoor with DH modulus prime? Some have argued that with a prime modulus you can just get the order by doing p-1 and then factor it, thus it is easy to reverse. I argue that this is not true.
The prime case
Our modulus is a prime $p$ such that the order of the group is $p-1 = p_1^{k_1} \times \cdots \times p_n^{k_n}$
For the backdoor to work, the discrete log should be do-able in groups of order $p_i^{k_i}$
For the NOBUS to work, you shouldn't be able to find the factors $p_i^{k_i}$
The non-prime case
Our modulus is now a composite $n = p_1^{k_1} \times \cdots \times p_n^{k_n}$ such that the order of the group is $p_1^{k_1-1}(p_1-1) \times \cdots \times p_n^{k_n-1}(p_n -1)$
For the backdoor to work, the discrete log should be do-able in groups of order $p_i^{k_i-1}(p_i-1)$
For the NOBUS to work, you shouldn't be able to find the factors $p_i^{k_i}$
The difference?
I see almost no difference between these two problems. It seems like a NOBUS backdoor could as easily be created with a prime modulus as with non-prime one.
Thoughts?