Small subgroup confinement attack

In cryptography, a subgroup confinement attack (or small subgroup confinement attack) on a cryptographic method that operates in a large finite group is where an attacker attempts to compromise the method by forcing a key to be confined to an unexpectedly small subgroup of the desired group.

Several methods have been found to be vulnerable to subgroup confinement attack, including some forms or applications of Diffie-Hellman key exchange and DH-EKE.