MathLabs
TheoremProved

Diffie-Hellman Shared Secret Agreement

Statement

Fix a prime pp and a base gg. If Alice picks a secret aa and sends A=ga mod pA = g^a \bmod p, and Bob picks a secret bb and sends B=gb mod pB = g^b \bmod p, then computing Ba mod pB^a \bmod p and Ab mod pA^b \bmod p both yield the same value gab mod pg^{ab} \bmod p, even though neither aa nor bb was ever transmitted.

Why is it true?

This is what lets two parties agree on a secret key over a public channel that an eavesdropper is watching: the eavesdropper sees the base, the modulus, and both public values, but recovering the shared secret from these requires solving a discrete logarithm, believed to be computationally hard for well-chosen parameters.

Proof sketch

By definition A=ga mod pA = g^a \bmod p and B=gb mod pB = g^b \bmod p are the results of modular exponentiation, so Bob receives AA and computes Ba=(gb)a mod pB^a = (g^b)^a \bmod p, while Alice receives BB and computes Ab=(ga)b mod pA^b = (g^a)^b \bmod p.

Modular exponentiation obeys the same law of exponents as ordinary exponentiation, because repeated multiplication modulo pp composes exactly like repeated multiplication of integers, only reduced modulo pp at each step: (gb)a=gba=gab=(ga)b(g^b)^a = g^{ba} = g^{ab} = (g^a)^b as exponents of gg, and this equality survives reduction modulo pp at every stage.

Therefore Ba mod p=gab mod p=Ab mod pB^a \bmod p = g^{ab} \bmod p = A^b \bmod p: Alice and Bob independently compute the same quantity gab mod pg^{ab} \bmod p from their own secret exponent and the other party's public value, without either secret aa or bb ever appearing on the channel.

The security argument is separate from this correctness argument: correctness only shows both parties land on the same number; hardness of computing aa from gg, pp, and AA (the discrete logarithm problem) is what keeps that shared number secret from an observer.

Topics that use this theorem

Step-by-step proofs

No step-by-step proof yet for this theorem.

References

  1. Alfred J. Menezes, Paul C. van Oorschot, Scott A. Vanstone (1996). Handbook of Applied Cryptography
  2. Peter W. Shor (1994). Algorithms for Quantum Computation: Discrete Logarithms and Factoring · arXiv:quant-ph/9508027
  3. National Institute of Standards and Technology (2024). Module-Lattice-Based Key-Encapsulation Mechanism Standard (FIPS 203)