The order of "G" should have a large prime factor to prevent use of the Pohlig–Hellman algorithm to obtain "a" or "b". For this reason, a Sophie Germain prime "q" is sometimes used to calculate , called a safe prime, since the order of "G" is then only divisible by 2 and "q". "g" is then sometimes chosen to generate the order "q" subgroup of "G", rather than "G", so that the Legendre symbol of "ga" never reveals the low order bit of "a". A protocol using such a choice is for example IKEv2.