对数字签名算法的数学攻击

Question

Does anybody know the mathematics behind an attack on DSA where modulus p has p-1 made up of only small factors. In reality, this would not happen as the key generator would guarantee that this is not so.

There is much information on the web on generating good input paramters for DSA so that it is hard to crack but no information on how you find X if modulus p has p-1 made up of only small factors.

Answer 1

Pohlig-Hellman would work.

However, the DSA standard explicitly requires that one of the prime factors of p-1 is large.