This question already has an answer here:
I'm on the study of Diffie-Hellman and its related math (multiplicative group of integers $\mod n$).
In some crypto papers and documents I've read that $g$ needs to be a primitive root mod $n$ ($g$ order in $G = \phi(p)$), but we actually use $g$ as a generator of a large subgroup of order $q$, where $q$ is a large prime extracted from $(n-1)/2$ ($p$ is a safe prime). So $g$ isn't a primitive root modulo $n$, because $g$ doesn't generate the entire group of $n-1$ but generates a subgroup of length $q$.
I understand that if a prime number (say 'x') divides the group's order then a generator exists whose order in G is 'x'. This is the current schema in the implementations of Diffie-Hellman (like I said before).
Example: $q = 1349363$; $p=2q+1=2698727$. So $\phi(p) = p-1$, $q|p-1$ so a generator $g$ exists whose order in $G$ is $q$.
And here's my opinion: I think this is used because doing modular exponentiation on big generators is slow, so we can use $2$ as a generator. It will generate a lower subgroup of elements, but if $q$ is big enough, it will increase the math performance without being insecure. Correct me if I'm wrong.
But I wish to clear the following doubts:
Why is not recommended to use a primitive root mod $n$ in Diffie-Hellman? Why do some crypto papers say that a primitive root modulo $n$ is needed?
According to For Diffie-Hellman, must g be a generator? So a primitive root modulo $n$ (or a true generator) isn't chosen because its order in $G$ is composite. Thus it reveals information about the private exponent. Instead, a generator of a subgroup of order $q$ (factor of |G|) is used, where $q$ is prime and large enough. Is this correct?