Diffie–Hellman key exchange

http://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange

 

Diffie–Hellman key exchange

 

The simplest, and original, implementation of the protocol uses the multiplicative group of integers modulo p, where p is prime and g is primitive root mod p. Here is an example of the protocol, with non-secret values inblue, and secret values inboldface red:

Alice Bob Secret Public Calculates Sends Calculates Public Secret a p, g   p,g     b a p, g, A ga mod p = A A   p, g b a p, g, A   B gb mod p = B p, g, A, B b a, s p, g, A, B Ba mod p = s   Ab mod p = s p, g, A, B b, s

1. Alice and Bob agree to use a prime numberp=23 and baseg=5.
2. Alice chooses a secret integer a=6, then sends BobA =g^a modp
   • A = 5⁶ mod23
   • A = 15,625 mod23
   • A = 8
3. Bob chooses a secret integer b=15, then sends AliceB =g^b modp
   • B = 5¹⁵ mod23
   • B = 30,517,578,125 mod23
   • B = 19
4. Alice computes s = B^a modp
   • s = 19⁶ mod 23
   • s = 47,045,881 mod23
   • s = 2
5. Bob computes s = A^b modp
   • s = 8¹⁵ mod 23
   • s = 35,184,372,088,832 mod23
   • s = 2
6. Alice and Bob now share a secret: s =2. This is because6*15 is the same as15*6. So somebody who had known both these private integers might also have calculateds as follows:
   • s = 5^6*15 mod 23
   • s = 5^15*6 mod 23
   • s = 5⁹⁰ mod 23
   • s = 807,793,566,946,316,088,741,610,050,849,573,099,185,363,389,551,639,556,884,765,625 mod23
   • s = 2

Both Alice and Bob have arrived at the same value, because (g^a)^b and (g^b)^a are equal modp. Note that onlya,b andg^ab = g^ba modp are kept secret. All the other values –p,g,g^a mod p, andg^b mod p – are sent in the clear. Once Alice and Bob compute the shared secret they can use it as an encryption key, known only to them, for sending messages across the same open communications channel. Of course, much larger values ofa, b, and p would be needed to make this example secure, since it is easy to try all the possible values ofg^ab mod 23. There are only 23 possible integers as the result of mod 23. Ifp were a prime of at least 300 digits, and a and b were at least 100 digits long, then even the best algorithms known today could not finda given onlyg,p,g^b mod p andg^a modp, even using all of mankind's computing power. The problem is known as thediscrete logarithm problem. Note thatg need not be large at all, and in practice is usually either 2 or 5.

 

 

Here's a more general description of the protocol:

1. Alice and Bob agree on a finite cyclic group G and a generating element g in G. (This is usually done long before the rest of the protocol;g is assumed to be known by all attackers.) We will write the groupG multiplicatively.
2. Alice picks a random natural number a and sends g^a to Bob.
3. Bob picks a random natural number b and sends g^b to Alice.
4. Alice computes (g^b)^a.
5. Bob computes (g^a)^b.

Both Alice and Bob are now in possession of the group element g^ab, which can serve as the shared secret key. The values of (g^b)^a and (g^a)^b are the same because groups are power associative. (See also exponentiation.)

In order to decrypt a message m, sent as mg^ab, Bob (or Alice) must first compute(g^ab)^-1, as follows:

Bob knows |G|, b, and g^a. A result from group theory establishes that from the construction of G,x^|G| = 1 for allx inG.

Bob then calculates (g^a)^|G|-b = g^a(|G|-b) = g^a|G|-ab = g^a|G|g^-ab = (g^|G|)^ag^-ab=1^ag^-ab=g^-ab=(g^ab)^-1.

When Alice sends Bob the encrypted message, mg^ab, Bob applies(g^ab)^-1 and recoversmg^ab(g^ab)^-1 = m(1) = m.

 

Operation with more than two parties

Diffie-Hellman key agreement is not limited to negotiating a key shared by only two participants. Any number of users can take part in an agreement by performing iterations of the agreement protocol and exchanging intermediate data (which does not itself need to be kept secret). For example, Alice, Bob, and Carol could participate in a Diffie-Hellman agreement as follows, with all operations taken to be modulop:

1. The parties agree on the algorithm parameters p and g.
2. The parties generate their private keys, named a, b, and c.
3. Alice computes g^a and sends it to Bob.
4. Bob computes (g^a)^b =g^ab and sends it to Carol.
5. Carol computes (g^ab)^c =g^abc and uses it as her secret.
6. Bob computes g^b and sends it to Carol.
7. Carol computes (g^b)^c =g^bc and sends it to Alice.
8. Alice computes (g^bc)^a =g^bca =g^abc and uses it as her secret.
9. Carol computes g^c and sends it to Alice.
10. Alice computes (g^c)^a =g^ca and sends it to Bob.
11. Bob computes (g^ca)^b =g^cab =g^abc and uses it as his secret.

An eavesdropper has been able to see g^a,g^b,g^c,g^ab,g^ac, andg^bc, but cannot use any combination of these to reproduceg^abc.

To extend this mechanism to larger groups, two basic principles must be followed:

• Starting with an “empty” key consisting only of g, the secret is made by raising the current value to every participant’s private exponent once, in any order (the first such exponentiation yields the participant’s own public key).
• Any intermediate value (having up to N − 1 exponents applied, whereN is the number of participants in the group) may be revealed publicly, but the final value (having had allN exponents applied) constitutes the shared secret and hence must never be revealed publicly. Thus, each user must obtain their copy of the secret by applying their own private key last (otherwise there would be no way for the last contributor to communicate the final key to its recipient, as that last contributor would have turned the key into the very secret the group wished to protect).

These principles leave open various options for choosing in which order participants contribute to keys. The simplest and most obvious solution is to arrange theN participants in a circle and haveN keys rotate around the circle, until eventually every key has been contributed to by allN participants (ending with its owner) and each participant has contributed toN keys (ending with their own). However, this requires that every participant performN modular exponentiations.

By choosing a more optimal order, and relying on the fact that keys can be duplicated, it is possible to reduce the number of modular exponentiations performed by each participant tolog ₂N + 1 using a divide-and-conquer-style approach, given here for eight participants:

1. Participants A, B, C, and D each perform one exponentiation, yielding g^abcd; this value is sent to E, F, G, and H. In return, participants A, B, C, and D receiveg^efgh.
2. Participants A and B each perform one exponentiation, yielding g^efghab, which they send to C and D, while C and D do the same, yieldingg^efghcd, which they send to A and B.
3. Participant A performs an exponentiation, yielding g^efghcda, which it sends to B; similarly, B sendsg^efghcdb to A. C and D do similarly.
4. Participant A performs one final exponentiation, yielding the secret g^efghcdba = g^abcdefgh, while B does the same to getg^efghcdab =g^abcdefgh; again, C and D do similarly.
5. Participants E through H simultaneously perform the same operations using g^abcd as their starting point.

Upon completing this algorithm, all participants will possess the secret g^abcdefgh, but each participant will have performed only four modular exponentiations, rather than the eight implied by a simple circular arrangement.