-1

How can I use these properties to attack the DHKE? I know that the order of $a$ is always $2$ for $a = P - 1$ in $Z_p$. The subgroups generated by a will be $\{1,a\}$.

e-sushi
  • 17,891
  • 12
  • 83
  • 229
Kenan Sooklall
  • 1
  • 3
    Quoting our help-section: “…please provide an indication of what you are not understanding and your attempts at solving it, so we have a clear indication of where you are stuck. This goes for all questions, not just homework. [If you have just written out your assignment, your question will be closed.](http://crypto.stackexchange.com/help/on-topic) You might want to read this article and this article on writing the perfect question.” – e-sushi Jun 19 '15 at 02:25
  • We don't have a good question about small subgroup attacks and IMO we should have one. But I'm not sure if we should use this one (edited if necessary), or if we should create a well written canonical question, and close this one as duplicate of it. – CodesInChaos Jun 19 '15 at 09:18
  • Related question: Solving discrete logarithm when p is not a safe prime – CodesInChaos Jun 19 '15 at 09:20

1 Answers1

1

If the order of $a=-1\mod{p}$ and $b=a^{e}\mod{p}$, then $b=\pm{1}\mod{p}$.
If $b=1\mod{p}$, the discrete logarithm is $0$.
If $b=-1\mod{p}$, the discrete logarithm is $1$.

e-sushi
  • 17,891
  • 12
  • 83
  • 229
lily wilson
  • 457
  • 3
  • 15