Diffie-Hellman
Two people who have never met agree on a number, in public, while somebody reads every message. That sounds impossible and is arithmetic. Everything that crossed the wire is printed on this page and it still does not help her. Then the prime is made small enough that it does help her, because the security here is not a property of the protocol: it is a property of how long the search takes.
A shared secret, everything that was sent, and the size at which the eavesdropper wins
1 Two private numbers, neither of which crosses the wire
Each side picks a number and keeps it. Nothing on this page ever sends these, and the eavesdropper's column below never contains them.
2 What does cross it, in full
The prime and the generator are public, and so are the two mixed numbers. This is the entire conversation: four numbers, all of them visible to anybody listening.
- the prime, public
- 20,749
- the generator, public
- 5 (does not reach every residue)
- what one side sent
- 15,028
- what the other sent
- 3,679
3 The same shared secret, arrived at from both ends
Each side raises what it received to the power of what it kept. Different arithmetic on each side, and the same answer, which is the whole trick.
- one side computes
- 19,047
- the other computes
- 19,047
- do they match
- yes, and neither sent it
4 Shrink the prime until the eavesdropper wins, and count the attempts
Now make the prime small. The eavesdropper has the prime, the generator and both public numbers, and she simply tries every exponent until one fits. The attempts are counted, and the count is the only thing standing between her and the secret.
- attempts before she found one
- 317
- the exponent she used
- 317
- was it the one they picked
- yes
- the secret she ended up with
- 19,047 — the same secret
With a prime of 20,749 the eavesdropper tried 317 exponents before one fitted. Everything she used is in the rows above. A real exchange uses a prime of two thousand bits and the same search does not finish.
What is real here, and what is not
These primes are toys, and the real ones are unimaginably larger
Everything here fits in a browser's ordinary numbers, so the largest prime on the slider is six figures. A real exchange uses a prime of two thousand bits or more, and the brute force shown here would not finish before the sun does. The mechanism is identical; only the size differs, and the size is the entire security argument.
The eavesdropper does not need your private key, only one that behaves like it
When the generator does not reach every residue, several exponents produce the same public value, and any of them reproduces the shared secret. The readout says whether she recovered the number that was actually chosen or merely an equivalent one, because on some of these primes she recovers an equivalent one and it works just as well. That is why the order of the generator matters as much as the size of the prime.
A small private exponent is found instantly, whatever the prime is
Brute force counts up from one, so an exchange that keeps a small number is broken in as many attempts as that number, on a prime of any size. Drag the private sliders down and watch the attempt count collapse while the prime stays put. The security needs the exponent to be large and unpredictable, not just the prime to be large.
There is no authentication here at all
This is the exchange as the 1976 paper describes it, and it establishes a shared secret with whoever is on the other end. It does not establish who that is. An attacker who can change messages rather than only read them can run the exchange twice, once with each side, and sit in the middle of it. Everything that answers that is later work and none of it is on this page.