Engineering / Mathematics — Abelian Groups
Subgroups
Subgroups, the subgroup test, generated subgroups, and the subgroup lattice of a finite group.
Executive summary
A subgroup is a subset closed under the operation and inverses. Verifying this is far easier than checking the full axioms, because associativity is inherited.
The subgroup lattice of a group determines much of its computational behaviour, and controlling that lattice is the central design concern in discrete-log cryptography.
Learning objectives
- Apply the subgroup test.
- Describe the subgroup generated by an element or set.
- Relate the subgroup lattice to cryptographic security.
01The subgroup test
Subgroup
A non-empty subset H ⊆ G that is itself a group under the operation of G.
Subgroup test
A non-empty subset H is a subgroup if and only if ab⁻¹ ∈ H for all a, b ∈ H.
For finite H, closure under the operation alone suffices.
The finite case is worth noting: closure implies the presence of inverses, because the powers of any element cycle back to the identity, and the previous power in that cycle is the inverse. No separate inverse check is needed.
02Generated subgroups
Subgroup generated by an element
⟨a⟩ = {a^k : k ∈ Z}, the smallest subgroup containing a.
In a finite group this is {e, a, a², ..., a^{ord(a)−1}}, of size ord(a).
Every subgroup generated by a single element is cyclic, and understanding cyclic groups therefore covers a great deal of the structure of any abelian group.
For a set of generators, the generated subgroup is the set of all products of the generators and their inverses. In the abelian case this simplifies to the set of products of integer powers of each generator.
03The subgroup lattice and security
The subgroups of a finite cyclic group of order n correspond exactly to the divisors of n: one subgroup of each order dividing n, and no others.
| Group order | Subgroup structure | Discrete log difficulty |
|---|---|---|
| Product of small primes | Many small subgroups | Easy via Pohlig-Hellman |
| 2q with q prime | Only orders 1, 2, q, 2q | Hard in the order-q subgroup |
| Prime q | Only trivial and whole | Hard; no decomposition available |
This is precisely why safe primes and prime-order subgroups are specified in discrete-log protocols: they eliminate the small subgroups that would otherwise offer a decomposition.
04Frequently asked questions
Is the intersection of subgroups a subgroup?
Yes, always, and this is what makes the generated subgroup well defined as the intersection of all subgroups containing the generating set. The union of subgroups is generally not a subgroup.
Does every divisor of the group order give a subgroup?
For cyclic groups, yes, exactly one of each divisor order. For general finite abelian groups a subgroup of each divisor order exists but need not be unique. For non-abelian groups even existence can fail.
Why does closure suffice in the finite case?
Because the powers of an element in a finite closed set must eventually repeat, forcing a cycle through the identity. The element preceding the identity in that cycle is the inverse, so it lies in the set automatically.
Sources and method
Structural reference: Victor Shoup, A Computational Introduction to Number Theory and Algebra, Version 1, Cambridge University Press, 2005 — book pages 185-190.
This page carries the durable method layer only: definitions, constructions, algorithms, complexity results and selection criteria, authored originally for KEVOS. No text is transcribed or paraphrased from the source, and no numeric tables or benchmark data are reproduced — these are routed to live authoritative sources instead.
Author: Kevin Jogin. Last reviewed 2026-08-07.