Diffie–Hellman exchange

This teaching tool shows Diffie–Hellman with small integers. Choose a prime p and a primitive root g modulo p as the public group parameters. Alice chooses a private exponent a and Bob a private exponent b. Select Calculate to show the exchange. The examples fill all four inputs; editing any input clears the old result. Clear result keeps the inputs.

Alice publishes A = gᵃ mod p and Bob publishes B = gᵇ mod p. After exchanging A and B, Alice computes S_A = Bᵃ mod p and Bob computes S_B = Aᵇ mod p. Both equal gᵃᵇ mod p. All four modular powers are calculated independently, and both final values remain visible. The public exchange consists only of p, g, A and B. Private exponents and results are shown separately at each role for learning; this page does not conceal them from the viewer. Role colors are labels, not a color-mixing model.

Inputs must be whole numbers: 11 ≤ p ≤ 997, 2 ≤ g ≤ p−1 and 2 ≤ a,b ≤ p−2. The tool checks that p is prime and that g has order p−1: its powers generate every nonzero residue modulo p. This deliberately uses the full multiplicative group. Diffie–Hellman in a suitable smaller prime-order subgroup is also a valid and widely used construction; it is outside this tool’s selected model. Equal private exponents and a shared value of 1 are possible within these teaching examples.

Expand Calculation steps to inspect A, B, S_A or S_B. Exponent bits are processed from left to right, starting with remainder 1 and exponent prefix 0. Each row doubles the prefix, adds the current bit, squares the preceding remainder modulo p, and multiplies by the base modulo p when the bit is 1. The resulting remainder equals the base raised to that row’s prefix, modulo p. The table has at most ten rows for the supported exponents; it scrolls locally when needed.

These small groups and chosen exponents are unsuitable for real keys. Basic Diffie–Hellman alone does not authenticate the other participant and is vulnerable to a man-in-the-middle attack. The tool provides no secure random generation, authentication, key derivation or production protocol. Valid settings, including these example exponents, may be saved in the app’s local cookies. Returning within the app can retain the result and calculation-step selection; reloading restores settings and waits for Calculate.

Sources: RFC 2631, §2.1.1, for the public powers, independent shared-secret calculations and prime-order subgroup construction; MathWorld: Primitive Root, for full-group generator order. Historical parameter sizes and hash choices in RFC 2631 are not recommendations from this tool.