On Tue, Mar 19, 2002 at 05:38:06PM +0000, Jason Holt wrote: > I don't really understand the math very well. I assume that being a > generator has something to do with ensuring that a^b%n has a long period as n > increases.
DH_generate_parameters() always uses a safe prime as modulus, i.e. p such that q = (p-1)/2 is prime as well. Thus, the factorization of p-1 is 2q, and this leads to a simple subgroup structure of the multiplicative group mod p: There's the subgroup consisting just of the element 1; there's the subgroup consisting just of the numbers 1 and p-1; there's a subgroup consisting of q elements; and there's the full group with 2q elements. Every g with 1 < g < p-1 generates either the q-element subgroup, or the 2q-element group. That is, g^b mod p always has a long period if we avoid pathological cases such as g = 1. g being a generator (also called a primitive root) means that it generates the the 2q-element group. This is what DH_generate_parameters() is designed to ensure for the cases g = 2 and g = 5. But this requirement is actually pointless: A g that generates the q-element subgroup is just as good as one that generates the 2q-element group. In fact prime-order subgroups are usually preferred for many cryptographic purposes; for DH, if properly used (e.g. in ephemeral DH TLS ciphers suites), the difference does not matter at all. -- Bodo M�ller <[EMAIL PROTECTED]> PGP http://www.informatik.tu-darmstadt.de/TI/Mitarbeiter/moeller/0x36d2c658.html * TU Darmstadt, Theoretische Informatik, Alexanderstr. 10, D-64283 Darmstadt * Tel. +49-6151-16-6628, Fax +49-6151-16-6036 ______________________________________________________________________ OpenSSL Project http://www.openssl.org Development Mailing List [EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
