# Why does the modulus of Diffie–Hellman need to be a prime?

I read a lot about Diffie-Hellman, but there is one thing I dont understand: why does the modulus p need to be a prime? What if it would not be a prime?

Let $n:=p$ and you want to find $x$ with $g^{x} \equiv y \bmod pq$

Calculate the two easier DL problems:
${x_p}$ with $g^{x_p} \equiv y \bmod p$
${x_q}$ with $g^{x_q} \equiv y \bmod q$

Note that
$x_p \equiv x \bmod p-1$
$x_q \equiv x \bmod q-1$

With the chinese remainder theorem you can calculate $x'$ from $x_p$ and $x_q$ with
$x' \equiv x \bmod lcm(p-1, q-1)$

• Thank you. It is essential that adversary is supposed to be able to solve DL problem for prime-modulus groups from factorization. – Vadym Fedyukovych Dec 6 '15 at 20:39
• once you get $x \pmod{lcm(p-1, q-1)}$ how do you get it mod $(p-1)(q-1)$? – David 天宇 Wong Mar 5 '16 at 22:35

It has to do with the Diffie–Hellman assumption. The DH key exchange is secure in groups where the computational DH assumption holds. One of the simplest such groups is the multiplicative group modulo a large prime.

However, that is not necessarily required. At least some composite integers with unknown factors would make a secure Diffie–Hellman modulus, assuming factoring is hard.

• If the modulus is not prime, someone who knows the factorisation may break the DH. One can easily show that the modulus is prime and that proves that the DH is secure. On the other hand, you cannot prove that you do't know the factorisation of a composite modulus. – user27950 Nov 5 '15 at 11:51
• Ok, the security depends on Eve not to be able to find - if there are - factors of p. But how can Eve break DH if she knows factors of p? – Martin Nov 5 '15 at 12:01
• you can use the chinese remainder theorem – user27950 Nov 5 '15 at 14:56
• Yes, the factors need to be secret. One of the participants in an ephemeral key exchange could safely generate them (if they can be authenticated), but not sure it has any advantages over a prime modulus. – otus Nov 5 '15 at 17:23
• @Cryptostasis May I second Martin's request please? Exactly how would CRT help breaking CDH? – Vadym Fedyukovych Dec 5 '15 at 17:51

It does not need to be a prime. All that's required for the ciphering scheme to work for a (g, p) pair is that g is a generating element for the cyclic multiplicative group defined by p.

The opposition to using non-prime p usually based on the fact that knowing factorization of p makes the cipher easier to break by solving "easier" problems for each of its factors. However, this is nothing more than a logical fallacy. If the problem is hard to solve for a prime p, it will be as hard (or harder) to solve for any composite number that has p as a factor.

• Actually, it's the other way around if you consider that it's not $p$ compared to a multiple of $p$. It only makes sense to compare $p$ to some composite of equal length. And that implies the prime factors are at most half the size - which is a lot easier for each factor and combining them back together is comparably irrelevant due to CRT. Even if the full factorization is not known, every known small prime just reduces the size of the given problem. Btw., this question is over 3 years old. – tylo Jan 18 '19 at 19:15