Mathematical attack on the Digital Signature Algorithm

Question

Does anybody know the mathematics behind an attack on DSA where modulus p has p-1 made up of only small factors. In reality, this would not happen as the key generator would guarantee that this is not so.

There is much information on the web on generating good input paramters for DSA so that it is hard to crack but no information on how you find X if modulus p has p-1 made up of only small factors.

Answer 1

Pohlig-Hellman would work.

However, the DSA standard explicitly requires that one of the prime factors of p-1 is large.