This paper: An Interactive Identification Scheme Based on Discrete Logarithms and Factoring requires generating primes $p$ with the following special format:
We choose $p$ with the property that $p - 1$ has at least two large prime factors, so that the factorization of $p - 1$ is hard to recover.
Two questions that arise:
- How to formally define that a number has at least two large prime factors?
- Are there infinitely many such numbers, and are they easy to find?
I wrote a simple Python 3 program to test this (requires gmpy2 and secrets modules). Admittedly, it doesn't prove anything, but it gives me some reassurance that such primes are abundant.
It runs 100 times, generates two random 512-bit primes $s$ and $t$, and tests whether $p = j\times s \times t + 1$ is a prime, for a small $j$ in $\{1,\ldots,10000\}$.
While the format of $p$ in the program is more restricted than what the paper defines, the program runs quite fast, and is able to generate the required prime all the time (this holds at least for all the executions I did).
from gmpy2 import next_prime, is_prime
from secrets import randbits
for i in range(100):
s = next_prime(randbits(512))
t = next_prime(randbits(512))
for j in range(1, 10000):
p = j * s * t + 1
if (is_prime(p)):
print(i, j)
break
Edit: One way to formalize item 1 is to require that $p-1$ has at most $C$ prime factors, where $C$ is a constant. This MathOverflow answer states that it follows from the sieve theory that there is a small constant C (like 6). Does anyone know the exact result?