2

The context of this question is coming up with the parameters for the ElGamal encryption scheme.

One of the requirements for the parameters for ElGamal is that we have primes $p$ and $q$ such that $p = q \cdot k + 1$ for some $k$. For simplicity, let $k=2$. We also need a generator $g$ for $p$ such that $g^q \equiv 1 \pmod p$. (Feel free to correct me if I got any of this wrong).

However, according to this Crypto SE answer to “How to test if a number is a primitive root?”, a number $g$ is a generator of $p$ iff $g^{\varphi(p)/j} \not \equiv 1 \pmod p$ for all prime factors $j$ of $\varphi(p)$. Since $\varphi(p) = p-1$ (as $p$ is prime) and $p-1$ has just two prime factors, $2$ and $q$, we have $g^q \not\equiv 1 \pmod p$.

Doesn't this directly contradict the above requirement of ElGamal?

For a real world example, take IKE groups 1 and 2 from RFC 2409. With group 2, we have $p = $ some large prime and $(p-1)/2$ also equals some large prime. They give us the generator $g=2$. This checks out for ElGamal because $2^p \equiv 1 \pmod p$. I've also tested it with my implementation of ElGamal encryption and everything works fine. However, doesn't this contradict the definition for a generator? If I try to find a generator for $p$, the first one I get is $g=11$, because $11^q \not\equiv 1 \pmod p$ and $11^2 \not\equiv 1 \pmod p$. But if I use $g=11$, the encryption fails because, as far as I can tell, $11^q \not\equiv 1 \pmod p$.

Community
  • 1
Rhyzomatic
  • 215
  • 1
  • 5
  • http://crypto.stackexchange.com/a/831/991 ​ ​ –  Apr 03 '16 at 10:55
  • BTW: IKE groups 1 (768 bits) and 2 (1024 bits) are considered to be too small for use today, as it is likely that those could be broken by large real world adversaries. If you are considering using either of those two groups, you would be well advised to instead use group 14 (2048 bits). If, on the other hand, you were using those two groups as an example (to illustrate your question), well, to quote a wise woman: "never mind..." – poncho Apr 03 '16 at 17:26

1 Answers1

1

You are probably getting confused with the meaning of "generator" here. You are correct that a generator for the entire multiplicative group modulo $p$ cannot satisfy $g^q \equiv 1$ by definition.

However - assuming $k = 2$ here - what you probably read is that $g$ is the generator of the quadratic residues modulo $p$, and this group has order $(p - 1)/2$. A generator $g$ for that group is, obviously, a quadratic residue, meaning it is of the form $g = a^2 \pmod{p}$ for some group element $a$, and therefore must satisfy $g^q \equiv 1 \pmod{p}$, since $g^q = (a^2)^q = a^{2q} = a^{p - 1}$.

Does that clear it up?

Thomas
  • 7,478
  • 1
  • 31
  • 44
  • Ah. Does this mean that, for example, when the IKE memo says $g$ is a generator for $p$, they really mean $g$ is a generator for the quadratic residues mod $p$? – Rhyzomatic Apr 03 '16 at 10:59
  • 2
    What they really mean is that $g$ is the generator for the subgroup they'll be using during the exchange (which, in this case, happens to be the subgroup of quadratic residues) – poncho Apr 03 '16 at 17:24