Skip to main content

Questions tagged [safe-prime]

A safe prime is a prime number of the form 2q + 1, where q is also a prime.

Filter by
Sorted by
Tagged with
0 votes
0 answers
66 views

Difficulty of factoring large semiprime N if given a second value y = (p-1)*r, where r is a random large prime?

Lets say we have 2 public values: N and y $$ N = pq $$ $$ y = r(p-1) $$ Where p, q, and r are large primes, are different, have a large distance between them and are kept secret. I have three ...
block103's user avatar
2 votes
3 answers
243 views

Is any safe prime sufficient for a secure DH key exchange?

There are some very large safe primes listed here: https://en.wikipedia.org/wiki/Safe_and_Sophie_Germain_primes Would using any of them result in a secure DH construction? Generator is 2. The exponent ...
user avatar
0 votes
2 answers
385 views

Are Safe and Sophie Germain primes evenly distributed?

Do Safe and Sophie Germain primes maintain a relatively stable distribution as numbers get larger, or do they become rarified beyond a predictable value? This is important in one area of triangular ...
Zekchelovek's user avatar
1 vote
1 answer
388 views

DHKE: Why using safe prime gives us "safe" subgroups?

I come from the question here: Safe primes subgroup in Diffie–Hellman key exchange Where the accepted answer states that there are only 4 possible outcomes for the order of a subgroup when using a ...
Ymi's user avatar
  • 175
0 votes
1 answer
167 views

Safe primes subgroup in Diffie–Hellman key exchange

I'm trying to understand how the safe primes numbers are used in Diffie–Hellman key exchange. According to wiki: The order of G should have a large prime factor to prevent use of the Pohlig–Hellman ...
pacman's user avatar
  • 459
4 votes
2 answers
1k views

Optimize the speed of a safe prime finder in C

I am trying to implement the Schnorr’s identification protocol in C. I need a safe prime in order to be able to find a generator of the cyclic group efficiently. The problem is that my program takes ...
Prankster2k's user avatar
5 votes
2 answers
414 views

DDH hardness with shared public parameters

DDH is believed hard for subgroup of $ℤ^*_p$ with order $q=(p-1)/2$ when $p$ is a safe prime chosen randomly. What if $p$ isn't random: When parameters are shared, $p$ mightn't have been chosen ...
bs-'s user avatar
  • 83
2 votes
1 answer
85 views

What is the purpose of "q" in Safe Prime definition during key pair generation?

Consider the following case, given x(private key) and y(public key), how to determine whether this key pair is generated by a pre-defined Safe Prime Group(Say FFDHE, RFC 7919)? In context of SP800 ...
gx16's user avatar
  • 45
1 vote
0 answers
36 views

How does Diogenes prove equivalence of discreet logs despite the candidates not being composed of safe primes

In the paper describing a protocol for distributed RSA modulus generation, Diogenes, "[they] employ a special-purpose $\Sigma$-protocol based on [Sho00] for proving correctness of exponentiations ...
Nic's user avatar
  • 498
6 votes
1 answer
260 views

Finding large devious primes

Call a prime $p$ devious if $(p-1)/2$ is a Carmichael number. They are called devious since they superficially look like safe primes but are not. In particular, Diffie-Hellman using such a prime could ...
John Coleman's user avatar
2 votes
2 answers
179 views

Constraints on q for q-ary lattices?

In lattice cryptography, people often work with q-ary lattices so that we can use the hardness of short integer solution (SIS) and learning with errors (LWE). I saw in some notes that sometimes we ...
Karim's user avatar
  • 155
2 votes
1 answer
315 views

Inverse function of RSA and safe prime requirement of DH Key exchange

Ok so the inverse function of RSA encryption (that is decryption) is $ m \gets c^{d}\bmod N$ where $d$ is the secret exponent As I understand the hardness of RSA depends on two things: the Integer ...
Adeel Malik's user avatar
1 vote
2 answers
1k views

How to get the order of a group generator in DH?

For a DH parameter prime, if the generator $g$ is 2, how do I get the order $q$?
obvionaoe's user avatar
4 votes
0 answers
127 views

Source of very large prime numbers

The RSA cryptosystem makes use of $n=pq$ where $p, q$ are large prime numbers. With quantum computing, factorization might become easier, so it will probably be useful to use much much bigger $p$, $q$ ...
Basj's user avatar
  • 553
2 votes
1 answer
2k views

why to use a safe-prime in Diffie-Hellman key exchange?

In order for Diffie-Hellman to be extra secure we must use a safe prime which is (p – 1) / 2 will also be a prime. so my question is what extra benefit of using ...
KMG's user avatar
  • 403
2 votes
1 answer
359 views

Safe primes and subgroups

I've been reading about safe primes and their use in: Cryptography Engineering by Niels Ferguson, Bruce Schneier, and Tadayoshi Kohno. Having a safe prime $q$ with $q=2p+1$ where $p$ is a Sophie ...
mark23's user avatar
  • 23
5 votes
2 answers
302 views

Prime numbers of the form $(2^k)p+1$, for a given prime $p$

Let $p$ be a prime. (say 256 bit) Does there a exist a prime $q$ such that $q = (2^k)p + 1$, for a large $k$ (something like 256), if it does exist, is there a way to find out for which all $k$ such ...
MeV's user avatar
  • 149
1 vote
1 answer
1k views

List of big strong primes

I want to make a Diffie Hellman key exchange code using Python, but I'm afraid of just randomly picking $g$. I read on the answer of Thomas Pornin to this question How does one calculate a primitive ...
Ofek Tevet's user avatar
0 votes
0 answers
860 views

What are the safe primes for $p$ and $q$ ​used in ElGamal?

I need to generate a 2048 bit key for ElGamal and I was looking for the $p$ and $q$ for PGP but I couldn't find them. the only thing I could find was this RFC but those are not safe primes. Does ...
Jolo's user avatar
  • 1
1 vote
0 answers
52 views

How large a product out of 3 close-by factors need to be to avoid factorization?

For encryption a prime $P = 2 \cdot Q \cdot R \cdot S +1$ was used. An adversary want to solve the discrete log problem $m \equiv g^i \bmod P$. For this he want to use the Pholig-Hellmann algorithm. ...
J. Doe's user avatar
  • 453
6 votes
1 answer
246 views

What is the best strategy to avoid getting even orders in Shor's algorithm?

I do understand Shor's algorithm wants the order of an element to be even so that it can use the factoring identity and find a non-trivial factor. But is there a relationship between safe primes and ...
user45491's user avatar
  • 409
2 votes
1 answer
458 views

Distribution of safe primes generated using different techniques

Is there any difference in the distribution of safe primes generated by creating prime $q$ and testing $2q+1$ for primality, compared to generating a larger prime $p$ and testing $(p-1)/2$ instead? ...
forest's user avatar
  • 15.3k
1 vote
1 answer
308 views

How is the recommended NIST modulus for DLP chosen/calculated?

NIST recommends a 256-bit private key exponent for DLP with a 3072-bit modulus. From this answer it appears that the range of private key numbers is derived by calculating a prime modulus via $2⋅p$ ...
JohnGalt's user avatar
  • 546
3 votes
1 answer
368 views

Elgamal problem on $\mathbb{QR}_p$ with $p$ a safe prime

I need some orientation to solve the following problem: Let $p = 2q+1$ be a safe prime and $s(x)$ the smallest of the two square roots of $x$ modulo $p$. Then: Determine the distribution of $s(g^{ab}...
user1868607's user avatar
  • 1,243
9 votes
2 answers
6k views

How to efficiently generate a random safe prime of given length?

A prime $p$ is said to be safe prime if $(p-1)/2$ is also a prime. How to efficiently generate a safe prime? I have written the following code in sagemath which generates a random safe prime of 1536 ...
satya's user avatar
  • 1,414
3 votes
1 answer
359 views

Does choosing N to be product of safe primes avoid William's p+1 factoring attack on RSA?

In this post, I found that choosing RSA modulus $N$ to be product of safe primes avoids Willam's $p + 1$ factoring attack. Suppose $N = p \cdot q$, where $p$, $q$, $(p-1)/2$ and $(q-1)/2$ are primes. ...
satya's user avatar
  • 1,414
5 votes
1 answer
1k views

Complexity of solving the discrete logarithm problem for the group formed from product of 2 safe primes

The complexity of solving the discrete logarithm problem depends on the choice of the group $G$. A popular choice is $Z_p^*$ where $p$ is a safe prime (${p=2p' +1}$ and $p'$ is also prime). In this ...
omnomnom's user avatar
  • 491
3 votes
1 answer
795 views

Efficient algorithm for finding Sophie Germain primes

What's the industry standard for an efficient finding large Sophie Germain primes? As a part of request handling in my application, I need to generate Paillier key. My current approach is to ...
omnomnom's user avatar
  • 491
5 votes
1 answer
103 views

Checking if discrete logarithm is $\geq\frac{\varphi(p)}2$ in polynomial time?

Given $p$ a prime, $g$ generator of $\Bbb Z_p^*$, and $h\in\Bbb Z_p^*$, that uniquely defines some $z\in[0,\varphi(p)[$ such that $g^z\equiv h\pmod p$. Is it possible to determine in polynomial time ...
Turbo's user avatar
  • 930
3 votes
1 answer
2k views

How to generate safe primes in a verifiable way?

FIPS 186-3 (APPENDIX A: Generation and Validation of FFC Domain Parameters) specifies how to generate Finite Field Cryptography Domain parameters and how to perform an explicit domain parameter ...
adarim's user avatar
  • 31
-3 votes
1 answer
103 views

Are there stenography benefits to a "n-prime"?

As mentioned in this StackOverflow CodeGolf question, prime numbers can be redefined: One of my favorite definitions of the prime numbers goes as follows: 2 is the smallest prime. ...
makerofthings7's user avatar
3 votes
2 answers
1k views

How to interpret the article claiming NIST P-256 curve to be unsafe?

Here: http://safecurves.cr.yp.to/ , I read that the NIST P-256 elliptic-curve is not safe. The article lists several aspects (off-curve point, side-channel, etc.) where implementing P256 can fail the ...
PLL's user avatar
  • 31
10 votes
1 answer
1k views

When to use safe prime or Schnorr group

Protocols that use $\mathbb{Z}_{p}^*$ arithmetic often choose $p$ to be a safe prime ($p = 2q + 1$, for prime $q$) or to have the Schnorr group form ($p = rq + 1$, for prime $q$). I understand that ...
Conrado's user avatar
  • 6,474
12 votes
2 answers
5k views

Safe primes in RSA

It's my understanding that there's no longer a requisite of safe primes for $q$ and $p$ when choosing a RSA modulus. How is it that this does not change the hardness of factoring $N$?
boran's user avatar
  • 131
4 votes
1 answer
2k views

Unsafe prime in DH key exchange

How the use of unsafe prime in DH key exchange makes DH vulnerable to be broken? can anyone explain to me what is safe prime, and what is the difference between safe and strong prime? How the attacker ...
han's user avatar
  • 419
2 votes
1 answer
602 views

How is it possible that $g^q \equiv 1 \pmod p$ for a generator g?

The context of this question is coming up with the parameters for the ElGamal encryption scheme. One of the requirements for the parameters for ElGamal is that we have primes $p$ and $q$ such that $p =...
Rhyzomatic's user avatar
1 vote
1 answer
594 views

ssh-keygen DH Primality Testing

I'm pretty familiar with using ssh-keygen to create groups that go in the /etc/ssh/moduli file for the Diffie-Hellman Group Exchange in openssh. Reading over the man page, it says "By default, each ...
Blowfish's user avatar
1 vote
0 answers
566 views

Solving discrete logarithm when p is not a safe prime

If you have the cyclic group of integers modulo $p$, where $p$ is not a safe prime, as well as a generator $g$ with which for all factors $q$ of $(p-1)$, $g^{(p-1)/q} \ne 1$, This answer says that ...
robertkin's user avatar
  • 428
2 votes
1 answer
2k views

About Primitive roots mod n in Diffie-Hellman [duplicate]

I'm on the study of Diffie-Hellman and its related math (multiplicative group of integers $\mod n$). In some crypto papers and documents I've read that $g$ needs to be a primitive root mod $n$ ($g$ ...
kub0x's user avatar
  • 898
0 votes
1 answer
246 views

Of what use is my code for finding prime numbers of a certain size? [closed]

I've developed a bit of Mathematica code that can find primes within a range of numbers. For example, if I wanted all the primes between one million and two million, it could do that. Of what use is ...
user24719's user avatar
1 vote
1 answer
524 views

Why is factoring $p-1$ easy when $p$ is a safe prime?

A paper states: [...] $(p,g,y)$ is a correct ElGamal public key if $g^x=y\pmod p$. To verify this the order of $g$, and thus the factorization of $p-1$, is needed. This is easy for safe primes (i.e....
jklkjnk's user avatar
  • 19
1 vote
1 answer
1k views

ElGamal and Schnorr groups

As I gather, a normal practice for choosing a cyclic group for ElGamal key generation is to find a safe prime $p$ and use a multiplicative cyclic group with modulus $p$ and order $q = (p-1)/2$. ...
Mints97's user avatar
  • 246
5 votes
3 answers
3k views

Finding strong primes

Wikipedia lists the following conditions for a prime to be strong: $p-1$ has large prime factors. That is, $p = a_1 q_1 + 1$ for some integer $a_1$ and large prime $q_1$. $q_1-1$ has large prime ...
Mints97's user avatar
  • 246
3 votes
2 answers
3k views

Sophie Germain primes and safe primes

I am trying to find a list or table of safe prime numbers i.e. the ones that are based on the Sophie Germain primes i.e. $N = 2p + 1$ where $p$ is also prime. All I found till now is this database. ...
Tito's user avatar
  • 153
7 votes
1 answer
460 views

Malicious DH groups

Can an attacker construct a DH group, large enough to be considered secure (say, a modulus of 2048-bits), such that the group appears safe, but the attacker is able to solve the DLP in the group ...
xnyhps's user avatar
  • 223
3 votes
1 answer
889 views

Generator for Group $QR_{N}$

Let $N=PQ$, where $P=2p+1$ and $Q=2q+1$. $P,Q,p,q$ are prime numbers. $QR_{N}$ is the set of quadratic residues modulo $N$. Please help me to prove $QR_{N}$ is a cyclic group. Note: $QR_{P}$ and $...
user9219's user avatar
5 votes
4 answers
2k views

Why $n=pq$ with $p=2p'+1$ and $q=2q'+1$ instead of just $n=p'q'$ for RSA crypto?

For RSA cryptography, we know that the modulo $n$ is a product of two big prime numbers(say $p$ and $q$). However, in some documents I see an extension of $p=2p'+1$ and $q=2q'+1$ with $q'$ and $p'$ ...
eskoba's user avatar
  • 205
4 votes
1 answer
1k views

Why does openssl BN_generate_prime return only a fraction of the safe primes within the given bit range?

I went into prime generation issues the last week and eventually calculated 10^7 primes using erik tews safeprimegen python wrapper for openssl. (https://github.com/eriktews/gensafeprime) (System: ...
ABri's user avatar
  • 209
2 votes
1 answer
338 views

Selecting a large NUMS Safe prime

Suppose I want to use the following simple hash function. For a mesage $m$, take some public $a$ and prime $p$ and raise $a^m \bmod p$ (never mind the computational expense of this operation). This ...
dspyz's user avatar
  • 167
1 vote
1 answer
256 views

Can one detect if two pairs of elements in Zp have the same exponential relation?

Suppose that $p$ is a safe prime of 2048 bits ($p = 2q + 1$, and $q$ is prime). Suppose that one is given two pairs $(x_1, y_1)$ and $(x_2, y_2)$ such that: $y_1 = x_1^{r_1} \pmod p$ $y_2 = x_2^{r_2}...
SDL's user avatar
  • 1,877