Diffie-Hellman Shared Secret Agreement
Statement
Fix a prime and a base . If Alice picks a secret and sends , and Bob picks a secret and sends , then computing and both yield the same value , even though neither nor was ever transmitted.
Why is it true?
This is what lets two parties agree on a secret key over a public channel that an eavesdropper is watching: the eavesdropper sees the base, the modulus, and both public values, but recovering the shared secret from these requires solving a discrete logarithm, believed to be computationally hard for well-chosen parameters.
Proof sketch
By definition and are the results of modular exponentiation, so Bob receives and computes , while Alice receives and computes .
Modular exponentiation obeys the same law of exponents as ordinary exponentiation, because repeated multiplication modulo composes exactly like repeated multiplication of integers, only reduced modulo at each step: as exponents of , and this equality survives reduction modulo at every stage.
Therefore : Alice and Bob independently compute the same quantity from their own secret exponent and the other party's public value, without either secret or ever appearing on the channel.
The security argument is separate from this correctness argument: correctness only shows both parties land on the same number; hardness of computing from , , and (the discrete logarithm problem) is what keeps that shared number secret from an observer.
Topics that use this theorem
Step-by-step proofs
No step-by-step proof yet for this theorem.
References
- Alfred J. Menezes, Paul C. van Oorschot, Scott A. Vanstone (1996). Handbook of Applied Cryptography
- Peter W. Shor (1994). Algorithms for Quantum Computation: Discrete Logarithms and Factoring · arXiv:quant-ph/9508027
- National Institute of Standards and Technology (2024). Module-Lattice-Based Key-Encapsulation Mechanism Standard (FIPS 203)