Safe primes and subgroups I've been reading about safe primes and their use in: Cryptography Engineering by Niels Ferguson, Bruce Schneier, and Tadayoshi Kohno.
Having a safe prime $q$ with $q=2p+1$ where $p$ is a Sophie Germain prime
They claim that the elements of the subgroup $p$ are the elements that are preferred to be used. Why?
Why not the elements in $2p$?
The Decisional Diffie-Hellman assumption, on which the key-exchange would be based on does not hold in $\mathbb{Z}_q^*$. The reason is that the Jacobi symbol &quot;leaks&quot; information about the shared key. Therefore one, instead, works with the subgroup of $\mathbb{Z}_q^*$ of order $p$, which is intuitively obtained by &quot;quotienting out&quot; this information. (This group is sometimes called the Schnorr group.) You can read the details on why DDH doesn't hold here (Exercise 2).