lowazo / pydhe Goto Github PK

Hi,

this is not exactly an issue, but there was no discussion thread. I wanted to ask you for advice on crafting instances of
{n,g} such that the CDH assumption holds. In particular, with the notation

g^a % n
g^b % n
g^(a*b) % n

I am actually not using the discrete logarithm not to create a common secret.

Instead, I "abuse" it so Alice will send g^a to Bob and h^a to Charlie. Thereby, B and C hold the same secret "a" of Alice; but they cannot tell that they hold the same secret because they cannot compare g^a and h^a.

So I actually need to be able, for a given prime n, to select millions of strong possible candidates for g.
Can I simply use a random number for each of them (since it cannot be co-prime with n, as n is prime)?
Of do all the g,h,... need to be primes themselves?

The question relates to the required nature of g,h,... with respect to n such that the CDH assumption holds valid.

Also, I am certain that there are pitfalls where the CDH is invalid in general; and I am thankful for all advice from you on how to avoid these pitfalls.

Thank you very much for any help. Kind regards, -