I was wondering if a group like the 1536-bit MODP Group from RFC 3526 was a Schnorr group?

A Schnorr group must apparently have:

  • $p$ and $q$ being primes
  • $p = q\cdot r+1$
  • $1 < h < p$
  • $h^r\not\equiv 1\pmod p$

And then $g = h^r\bmod p$ is the generator.

In RFC3526's 1536-bit MODP, there's a prime: $$2^{1536}-2^{1472}-1+2^{64}\cdot\lfloor2^{1406}\cdot\text{pi}+741804\rfloor$$ (not too sure what $\text{pi}$ is here)
and the generator is $g=2$.

My question is if such a group is a Schnorr group or not?

If it's a Schnorr group, what are the values or $p$, $q$, $r$ and $h$?

RFC3526 MODP Diffie-Hellman groups for IKE

  • $\begingroup$ I'd guess these are safe primes, so $r=2$, for Schnorr groups we generally select a much smaller $q$, only twice the security level. $\endgroup$ – CodesInChaos Apr 25 '14 at 15:12

Yes, it meets the formal definition of a Schnorr group; however it was constructed somewhat differently. Normally, when we generate a Schnorr group, we pick a prime $q$, and then search for an $r$ so that $qr+1$ is also prime; with the RFC3526 group, they picked $p$ and $q$ simultaneously. In addition, when it came to selecting the generator, they did not select the value $h$ and compute $g$ from that. Instead, they selected $p$ such that $g=2$ generated a prime subgroup.

As for the values you asked about:

$$p = 2^{1536} - 2^{1472} - 1 + 2^{64} * \lfloor 2^{1406} \pi + 741804 \rfloor$$

(and yes, $pi = \pi$ is everyone's favorite transcendental number)

$$q = (p-1)/2$$

$$r = 2$$

$$h = 2^{(p+1)/4} \bmod p$$

We have this rather odd looking $h$ because that makes $h^r \equiv 2$. Since Schnorr groups had no restriction on what $h$ is (other than $h^r \not\equiv 1$), this satisfies the definition.

  • $\begingroup$ thanks, this really helps me a lot... I thought it was a Schnorr group, but I couldn't understand how the generator could possibly be 2. $\endgroup$ – Cedric Martin Apr 25 '14 at 16:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.