Hi I previously asked a question about Diffie-Hellman parameters but wanted to make sure I got it right.
I need to generate parameters for the SRP protocol. My base strategy is to generate a safe prime q = 2*p + 1 where p is also a prime. I want to use as low generator as possible, preferably "2". Now, all elements of (Z/qZ) is going to have one of the following orders: 1, 2, p or 2*p due to the group having order 2*p, so 2 must generate a subgroup of one of those orders. Since q is large, we can exclude 1 and 2 as possibilities, leaving p and 2*p as the only possible orders of the subgroup. It can be easily determined which it is by simply checking if 2^p = 1 mod q.
Now my question is, which is cryptographically preferred for security against the discrete-log attack? I.e. is it preferred to select p and q such that 2 has order p, or is 2*p preferable? 2*p clearly implies a subgroup twice as big. On the other hand, p is prime. I don't know if there's any special benefit to the subgroup itself having prime order.