I read that Silver–Pohlig–Hellman algorithm solves the discrete logarithm with prime module $p$ in $O(\log^2(p))$ if $p-1$ is a smooth number. This seems pretty fatal for cryptography, since it is a polynomial over the key length, right?

So my questions are:

  1. How probable is this to happen?
  2. (How) can it be prevented?
  • 2
    $\begingroup$ "if $p−1$ is a smooth number", but if you choose a $p-1$ with large factors (e.g. twice a prime) then it's not smooth and the algo doesn't break it. $\endgroup$ Sep 16, 2013 at 13:14

1 Answer 1


Generally speaking, this algorithm uses the Chinese Remainder Theorem to split up the group order, and then uses a Babystep-Giantstep algorithm for each prime factor potency of the group order. If the group order is smooth (all prime factors are small, s.t. all BS-GS algorithms can be done efficiently), this can be done very efficiently.

However, the solution is pretty simple: Choose a safe prime as modulus: $p=2q+1$ (with $q$ prime), or a prime $p$ where $p-1$ contains at least one large factor, so that the BS-GS algorithm for this factor is too large (It has $\mathcal{O}(\sqrt{q})$ memory and time complexity for prime $q$).

For example this is done in DSA: Choose prime $q$ first, then calculate a prime $p$, where $p-1$ is a multiple of $q$. Examples for suggested key lengths $(|q|,|p|)$: (160,1024), (224,2048), (256,2048),...


To answer your first question: If you choose $p$ randomly, chances are high that your security is MUCH lower than you would expect:

For random $p$ , the chance of $p-1$ being divisible by a low prime $a$ is $\frac{1}{a-1}$. A random $p$ means that $(p-1)$ mod $a$ is uniform distributed in $[0,a-2]$.

Now, if $a$ is small, we can ignore the costs of the BS-GS algorithm for $a$, and you "loose" $\log_2{a}$ bits of security: The remaining problem doesn't have to be solved for group order $(p-1)$ but for $(p-1)/a$.

Since there are quite a lot of small prime numbers, you have a problem. Best to avoid this problem by choosing $p$ not totally random, but with $q$ large enough. (Choose q, calculate some $p$ and test them for primality).

  • 2
    $\begingroup$ Gaining $\log_2 a$ bits for all small prime factors $a$ is not a problem, as long as a big enough prime factor remains. For a 1024-bit random prime $p$, largest prime factor of $p-1$ will have, on average, about 300 bits, and it is extremely improbable that it would be smaller than 160 bits. So a random prime is safe. You still want to generate the modulus as $p = qr + 1$ for a given smaller prime $q$ because for some algorithms (in particular DSA) it is convenient to have a known relatively small subgroup order. But that's not a security measure. $\endgroup$ Sep 16, 2013 at 22:41
  • $\begingroup$ While gaining knowledge of the small prime factors of the group order might not be a problem in average, this is a gamble with unknown odds. The estimation of an average max-prime factor size of 300 seems good enough, but it does not estimate the risk of getting a smooth number without addressing this estimation's variance (or even the actual distribution). So unless you use an efficient factoring algorithm on $p-1$ yourself, you don't know how good your choice of $p$ is. But yeah, knowing a smaller subgroup can be very beneficial as well, esp. for DSA $\endgroup$
    – tylo
    Sep 17, 2013 at 12:18
  • 1
    $\begingroup$ Actually the probably of smoothness for a random integer (like $p-1$, for a random prime $p$) is well known through the Dickman-de Bruijn function. Also, if smooth numbers were not exceedingly rare, the elliptic curve factoring method would break RSA, since that method relies on hitting a smooth number (ok, that's a bit handwaving, but there's only so much math that can be crammed in a 500-character comment). $\endgroup$ Sep 17, 2013 at 12:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.