# In RSA, rationale for prime $p$ with $p-1$ having prime factor $u$ with $u-1$ having large prime factor?

In the 1978 RSA paper, it is recommended, among other things, to choose primes $p$ such that $(p-1)$ has a large prime factor $u$. This was motivated by Pollard's p-1 algorithm. Further, the authors state:

Additional security is provided by ensuring that $(u−1)$ also has a large prime factor.

What was the motivation for that?

-

It should be noted that elliptic curve factorization has made this security requirement redundant. On the other hand, ensuring `(p - 1)` has a large prime factor requires very little extra effort. – Brett Hale Jul 6 '12 at 8:44

## 1 Answer

This issue, and its history, was discussed at length in Silverman and Rivest. The relevant passage here is in Section 6, which I quote:

In 1977 Simmons and Norris [53] discussed the following "cycling" or "superencryption" attack on the RSA cryptosystem: given a ciphertext C, consider decrypting it by repeatedly encrypting it with the same public key used to produce it in the first place, until the message appears. Thus, one looks for a fixed point of the transformation of the plaintext under modular exponentiation. Since the encryption operation effects a permutation of $\mathbb{Z}_n = \{0,1,\ldots,n-1\}$, the message can eventually be obtained in this manner. Rivest [46] responds to their concern by (a) showing that the odds of success are minuscule if the n is the product of two $p^{--}$-strong primes, and (b) arguing that this attack is really a factoring algorithm in disguise, and should be compared with other factoring attacks.

-

– fgrieu Apr 7 '12 at 23:03
{"extraction_info": {"found_math": true, "script_math_tex": 0, "script_math_asciimath": 0, "math_annotations": 0, "math_alttext": 0, "mathml": 0, "mathjax_tag": 0, "mathjax_inline_tex": 10, "mathjax_display_tex": 0, "mathjax_asciimath": 0, "img_math": 0, "codecogs_latex": 0, "wp_latex": 0, "mimetex.cgi": 0, "/images/math/codecogs": 0, "mathtex.cgi": 0}, "config": {"markdown_headings": true, "markdown_code": true, "boilerplate_config": {"ratio_threshold": 0.18, "absolute_threshold": 10, "end_threshold": 15, "enable": true}, "remove_buttons": true, "remove_image_figures": true, "remove_link_clusters": true, "table_config": {"min_rows": 2, "min_cols": 3, "format": "github"}, "remove_chinese": true, "remove_edit_buttons": true, "extract_latex": true}, "english_confidence": 0.9594439268112183, "perplexity_flag": "middle"}