# Choosing between additive or multiplicative group for Diffie-Hellman

I am trying to construct a theoretical Diffie-Hellman key exchange protocol. However, i cannot understand the difference between choosing an additive group or a multiplicative group. I believe an additive would make it much more simple, but would a multiplicative group make it more difficult to break? What would be the difference between the use of those 2 kinds of number groups?

• – SEJPM Jan 29 '17 at 21:27
• Maybe that is poor mathematical way of asking between elliptical curve dhe and rsa. The trade off being security for performance. Most application use elliptical curve to exchange rsa parameters for encryption. – marshal craft Jan 30 '17 at 6:57

From an abstract algebraic point of view the two are one and the same, a group.

However, depending on how that group is defined additional structure may make additional operations possible or easy that are detrimental to your security.

For example: In a finite field of prime order calculating logarithms is hard but division is easy.

More mathematically the two problems are

• calculating $x$ given $g$ and $g^x$
• calculating $x'$ given $g$ and $x' \cdot g$

and they have totally different complexities.

Both addition and multiplication in this case define a group but integer multiplication is not hard to invert.

And, the usual disclaimer, please don't design your own crypto unless for exercises. ;)

• Thanks! Not designing my Crypto, but trying to understand the difference. I knew the choice would be multiplicative, but additive would be more obvious and easy to use. – Galinho Salonica Jan 29 '17 at 20:22
• Well, if you use elliptic curves the operation is usually written additively. As I said algebraically they are the same and it doesn't really matter which symbol you use. So why do you think additive would be easier to use? – Elias Jan 29 '17 at 20:24
• Is it a fact that using an additive group, the Discrete Logarithm Problem would be equal a linear problem to solve, making it possible f.e. to solve it with extended Euclidean algorithm? – Galinho Salonica Jan 29 '17 at 20:29
• Again, if you are only talking about a group it does not matter if your symbol is $+$ or $\cdot$. So no, it is not generally easy to solve the discrete logarithm problem. See, e.g. elliptic curves. – Elias Jan 29 '17 at 20:59

No difference. The operation of the group does not have to do with the security. The addition or multiplication is just a convention we make to write the operations between the elements of the group. Of course in some groups, say ${\bf Z}_p^{*}$ we use the multiplication symbol because the operation is multiplication $\mod p.$ In elliptic curves, always we use the addition symbol.