How can I use these properties to attack the DHKE? I know that the order of $a$ is always $2$ for $a = P - 1$ in $Z_p$. The subgroups generated by a will be $\{1,a\}$.
-1
$\begingroup$
$\endgroup$
closed as off-topic by e-sushi, cygnusv, yyyyyyy, poncho, SEJPM♦ Jun 20 '15 at 20:48
- This question does not appear to be about cryptography within the scope defined in the help center.
-
3$\begingroup$ Quoting our help-section: “…please provide an indication of what you are not understanding and your attempts at solving it, so we have a clear indication of where you are stuck. This goes for all questions, not just homework. If you have just written out your assignment, your question will be closed. You might want to read this article and this article on writing the perfect question.” $\endgroup$ – e-sushi Jun 19 '15 at 2:25
-
$\begingroup$ We don't have a good question about small subgroup attacks and IMO we should have one. But I'm not sure if we should use this one (edited if necessary), or if we should create a well written canonical question, and close this one as duplicate of it. $\endgroup$ – CodesInChaos Jun 19 '15 at 9:18
-
$\begingroup$ Related question: Solving discrete logarithm when p is not a safe prime $\endgroup$ – CodesInChaos Jun 19 '15 at 9:20
1
$\begingroup$
$\endgroup$
If the order of $a=-1\mod{p}$ and $b=a^{e}\mod{p}$, then $b=\pm{1}\mod{p}$.
If $b=1\mod{p}$, the discrete logarithm is $0$.
If $b=-1\mod{p}$, the discrete logarithm is $1$.
