← Hall of Foundations Exhibit 149 · ⟨g⟩
The Grammar of Public-Key Cryptography

The vocabulary
everything shares

Groups, generators, order. These three words describe the structure half of modern cryptography quietly depends on. A group is a set with one well-behaved operation; a generator is an element whose repeated application reaches everything; the order is how many steps that takes.

The unifying abstraction. Diffie–Hellman's clock, elliptic-curve points, RSA's invertible residues under multiplication — these look different but are all groups. Learn the vocabulary once and every scheme reads the same.
§1

Generators and the ground they cover

Take the numbers 0 to n−1 with addition that wraps around — the group ℤ/nℤ. Pick a generator g and keep adding it to itself: g, 2g, 3g, … Some choices sweep through every element before returning to 0; others get trapped in a small sub-cycle. Watch which is which.

—
When ⟨g⟩ covers all n elements, g is a generator and the group is cyclic under it. Otherwise g reaches only a subgroup — and its order divides n (Lagrange's theorem, live).
§2

Why cryptographers care about order

The order of an element is the number of additions needed to reach the identity again. Discrete-log protocols generally use large prime-order subgroups and validate public values. A large order is necessary but does not make every group secure.

order of g = smallest k > 0 with k·g ≡ 0  (divides n)
Where this touches your keys

The discrete-log family, in one skeleton

ECDH walks a generator point around an elliptic-curve group. Diffie–Hellman walks a generator through residues mod a prime. Schnorr-style signatures live in prime-order groups by design. Once you see the generator and its order, every scheme in that family reads the same way.

Post-quantum standards use different assumptions: ML-KEM uses Module-LWE, ML-DSA uses module-lattice assumptions including Module-LWE and Module-SIS-related problems, and SLH-DSA uses hash-based constructions. Rings and modules also have underlying groups. Their expected quantum resistance is not proved merely by calling them something other than cyclic groups; it rests on the absence of efficient known attacks for the chosen problems and parameters.

Related: Modular Arithmetic is this exhibit's multiplicative cousin.

Sources and scope: NIST FIPS 203, 204 and 205 (2024).