Breaking generalized Diffie–Hellman modulo a composite is no easier than factoring