Standards for finite-field discrete log cryptography The NIST and TLS standards for Diffie-Hellman key exchange over a finite field all work in a subgroup of ${\mathbb Z}_p^*$ having prime order $q$, where $p = 2q+1$. On the other hand, DSA has a larger cofactor, i.e., it works in a subgroup of ${\mathbb Z}_p^*$ having prime order $q$, where $p = rq+1$ and $r \gg 2$. The latter makes sense because it gives better efficiency while still giving the same security against known attacks.

So, why do the NIST/TLS standards not allow for cofactors greater than 2?
So, why do the NIST/TLS standards not allow for cofactors greater than 2?


Actually, NIST does allow larger cofactors - see table 1 in SP800-56A - they allow the subgroup (q) to be significantly smaller than the modulus (p).

As for TLS, previous versions of TLS (1.2 and earlier) did allow the server to specify the group (and made no requirements about the cofactor).  In TLS 1.3, they allow only a handful of specific groups to be used, all with a cofactor of 2.  Is there a specific reason they should have included a group with a larger cofactor?