Schnorr group explained
A Schnorr group, proposed by Claus P. Schnorr, is a large prime-order subgroup of
, the
multiplicative group of integers modulo
for some
prime
. To generate such a group, generate
,
,
such that
with
,
prime. Then choose any
in the range
until you find one such that
.
This value
is a generator of a subgroup of
of order
.
Schnorr groups are useful in discrete log based cryptosystems including Schnorr signatures and DSA. In such applications, typically
is chosen to be large enough to resist
index calculus and related methods of solving the discrete-log problem (perhaps 1024 to 3072 bits), while
is large enough to resist the
birthday attack on discrete log problems, which works in any group (perhaps 160 to 256 bits). Because the Schnorr group is of prime order, it has no non-trivial proper subgroups, thwarting
confinement attacks due to small subgroups. Implementations of protocols that use Schnorr groups must verify where appropriate that integers supplied by other parties are in fact members of the Schnorr group;
is a member of the group if
and
. Any member of the group except the element
is also a generator of the group.
See also: Topics in cryptography.