The definition and origin of Schnorr groups? Wanting to write something on Schnorr groups in a publication I realised how hard it is to find anything citable about them on the internet. Who can help me with the following questions?


What (and where) is the actual definition of a Schnorr group? Are all of its criteria fulfilled if it is a multiplicative finite cyclic group with a prime order? In the answer to What is a cyclic group of prime order q such that the DLP is hard? it sounds like it is only a Schnorr Group if the $r$ in $p = qr + 1$ is $r&gt;2$?
Where have Schnorr groups first been introduced and who called them Schnorr groups? I checked the references in Security of Schnorr signature versus DSA and DLP, but I could not find anything useful in Schnorr's patents and his papers start off directly with:


  The KAC chooses primes $p$ and $q$ such that $q \mid p - 1, q \le 2^{214}, p &gt; 2^{512}$, $\alpha \in \mathbb{Z}_p$ with order $q$, i.e., $\alpha^q = 1 \pmod{p}$, $\alpha \neq 1$


So they already use Schnorr groups, but neither do they call them that nor do they give a procedure how to generate them. Which leads into my next question:
Where was a procedure to generate Schnorr groups first published? The Wikipedia article only gives a procedure without source, which is basically the same as in FIPS PUB 186-4, A.1 even though there it is not even called Schnorr group (proably due to patent reasons?).


UPDATE: Digging deeper I found this in PS96:


  results for other signature schemes like Schnorr's are considered as folklore results but have never appeared in the literature


"Folklore results"? Maybe that's why Schnorr groups are so difficult to grasp.
What (and where) is the actual definition of a Schnorr group?
  Where have Schnorr groups first been introduced and who called them Schnorr groups?
  


I don't know who first used the term—the earliest use I can dig up quickly is actually the Wikipedia article, initially drafted in November 2004 by Paul Crowley[1], who also used it a year earlier on sci.crypt[2].  What it means is a subgroup of prime order $q$ of the multiplicative group of the finite field $\mathbb Z/p\mathbb Z$, where $p$ is large enough (say 2048 bits) to resist index calculus on the field and $q$ is large enough (say 256 bits) to resist Pollard's $\rho$ or other generic discrete log attacks on the subgroup.

Cryptosystems defined in terms of Schnorr groups usually do not involve furnishing adversaries with oracles for $h \mapsto h^x$ for secret $x$, so minimizing $(p - 1)/q$ is not important as it is for, e.g., Diffie–Hellman; instead we make $q$ as small as we safely can to improve exponentiation performance.  So usually we don't consider the order-$q$ subgroup of $(\mathbb Z/p\mathbb Z)^\times$ with a safe prime $p = 2q + 1$ to be a Schnorr group.  But you wouldn't be disinvited from parties if you called it a trivial case of a Schnorr group with bad performance.


  
  Where was a procedure to generate Schnorr groups first published?
  


The generation procedure—randomly choose prime $q$ of appropriate size, randomly choose $k$ of appropriate size until $p := kq + 1$ is prime, and randomly choose $h$ until you find a generator $g := h^k \not\equiv 1 \pmod p$—is obvious enough that it's easy to imagine that nobody bothered to write it down in a paper to publish in an academic venue.


  
    results for other signature schemes like Schnorr's are considered as folklore results but have never appeared in the literature
  


What the ‘folklore’ comment means is that everyone tacitly felt they understood the result to be (perhaps intuitively or obviously) true, but nobody bothered to write a proof down or publish it, so there was nothing in the literature to formally cite.