# Malicious DH parameters without using composite numbers [duplicate]

I know that it's possible to generate DH parameters that lead to it being easy to attack (e.g. trivial composite numbers), but is it possible to create a malicious parameter that is not a composite number (and thus passes an arbitrary number of Miller-Rabin tests) but still makes attacking the DH group easy? It should be trivial to detect if the parameters have been generated to intentionally fall victim to the small subgroup attack, and the SNFV becomes impractical with realistic key sizes.

Questions similar to this have been asked before, but they seem to focus on composite numbers.

## marked as duplicate by forest, Community♦Feb 25 at 3:51

For finite-field DH, there's little reason to use anything other than the RFC 3526 groups, which use a modulus of the form $$2^n - 2^{n - 64} - 1 + 2^{64} (\lfloor 2^{n - 130} \pi \rfloor + c)$$ where $$c$$ is the smallest nonnegative integer making this number a safe prime congruent to 7 modulo 8.