In the step-3 of Attack in Practice section of Small Subgroup Confinement Attack, we generate elements that produce subgroup order p1e1.
This method can generate false positives in cases where the order of subgroup to be generated is non-prime. For example: if we want to generate elements having subgroup order 23, the method can generate elements having subgroup order 2, 22 other than elements having subgroup order 23.
PoC (sagemath):
q = 919
Zq = Zmod(q)
group_order = q-1
print(group_order)
assert group_order % (3^3) == 0
subgroup_order = 3^3
exp = group_order/subgroup_order
nfalse_positives = 0
for i in range(10000):
elem = Zq(randint(1, q-1))
res = elem**exp
if res != 1:
order = res.multiplicative_order()
if Integer(order) != sub_order:
nfalse_positives += 1
print("False positives: ", str(nfalse_positives))
Thanks to Vara Prasad for finding this issue and the PoC