Two strangers agree on a secret key while anyone can hear every word. How is that even possible, and what’s the catch?
Alice and Bob have never met. The only way they can talk is one where Eve hears every word. Can they, right now and in front of her, agree on a password that Eve won’t learn?
Intuition gives a firm “no.” Everything Bob knows reached him through the shared channel, so Eve knows it too. Where would Bob get anything she doesn’t have?
For thousands of years that was exactly how it worked. Every cipher, from Caesar’s to DES, needed the key delivered to both sides in advance by a trusted route: a courier, the diplomatic bag, hand to hand. Even the Moscow–Washington hotline, opened in 1963, ran on one-time key tapes that the two sides exchanged through their embassies. The more people needed to talk in secret, the heavier this logistics became.
First, what it actually is. Diffie–Hellman is not a cipher but a key agreement protocol. It encrypts nothing; it only gives Alice and Bob the same secret key. Their messages are then encrypted with that key by an ordinary cipher such as AES.
The whole protocol rests on one thing: an operation that is easy to do and hard to undo. It’s easiest to picture it with paints first.
There is a common paint that everyone knows. Alice and Bob each mix their own secret paint into it and swap the mixtures in the open. Then each adds their secret paint to the other’s mixture. Both cans end up holding the same color, and Eve, who sees both mixtures, can’t pull the secret paints back out.
A simplification: a real paint mixture can be separated in a lab. That’s why the protocol uses numbers instead of paints.
In the real protocol, “mixing” means modular exponentiation: raise a number to a power, divide the result by the modulus p and keep only the remainder. For example, 30 mod 23 = 7, because 30 = 1 · 23 + 7. Below, each step is given first in general form and then as a small example you can work out in your head. The game uses the same numbers by default, and there you can change them.
Alice and Bob openly agree on two numbers. p is the modulus, a large prime: in real systems it is 2048 bits or longer, that is, at least 617 decimal digits. g is the base that will be raised to powers. It is chosen so that the powers of g give as many different remainders as possible (more on this under “For the curious”). Ready-made pairs of p and g are usually taken from standards. Everyone knows them, Eve included: that’s not a leak; it’s by design.
Example: p = 23, g = 5.
Each picks a random secret number: Alice picks a, Bob picks b. In the real protocol these numbers are hundreds of bits long and are chosen afresh for every new connection. The secret numbers are never sent anywhere: they are the “secret paints.”
Example: a = 2, b = 3.
Alice computes A = ga mod p, Bob computes B = gb mod p. This is “mixing your paint with the common one.” A and B travel through the channel in the open, and Eve sees them.
Example: A = 5² mod 23: 5² = 25 = 1 · 23 + 2, so A = 2. B = 5³ mod 23: first the whole power, 5³ = 125, then division with remainder, 125 = 5 · 23 + 10, so B = 10.
Alice raises the B she received to her secret power: s = Ba mod p. Bob does the same with A: s = Ab mod p. The numbers come out equal, even though the key itself never went through the channel. In real systems s is as long as p, and a key for a symmetric cipher is then derived from it.
Example: Alice gets 10² = 100 = 4 · 23 + 8, Bob gets 2³ = 8 (less than 23, nothing to divide). Both have s = 8.
B is gb, so Alice gets Ba = gb·a, and Bob gets Ab = ga·b. Swapping the factors doesn’t change the product, just as a paint mixture doesn’t depend on the order of mixing. And the remainder after dividing by p can be taken at any stage without changing the result. The general formula: s = Ba = Ab = gab mod p.
In November 1976 Whitfield Diffie and Martin Hellman of Stanford published the paper “New Directions in Cryptography.” It opened with the words “We stand today on the brink of a revolution in cryptography.” The timing was right: computers were being linked into networks, and sending couriers with keys to everyone who wanted to talk to everyone else had become impossible. The idea was influenced by the work of Ralph Merkle, who was independently looking for a way to agree on a key in the open. Hellman later suggested calling the protocol Diffie–Hellman–Merkle key exchange.
The idea was in the air. At the British signals agency GCHQ, James Ellis described “non-secret encryption” back in 1970, and in 1974 Malcolm Williamson found essentially the same protocol. That work was classified and came to light only in 1997. So the protocol bears the names of those who published it openly, and in 2015 Diffie and Hellman received the Turing Award for public-key cryptography.
Today this exchange quietly runs in almost every secure connection:
Every TLS 1.3 connection begins with a Diffie–Hellman exchange, usually on the elliptic curve X25519. The secret numbers are chosen afresh for each connection and erased afterwards: even if the server is hacked later, old conversations can’t be decrypted. This property is called forward secrecy.
Signal and WhatsApp agree on chat keys through several Diffie–Hellman exchanges. Telegram’s MTProto protocol is built on this exchange too.
Remote logins and secure tunnels get their session key the same way. That key then encrypts the data with a symmetric cipher such as AES.
RSA is always mentioned alongside Diffie–Hellman. Both were invented in the 1970s, both work with public and secret numbers and both compute powers modulo a number, so they are easy to mix up. But they do different jobs. Diffie–Hellman encrypts nothing: it lets two people arrive at a shared key together. RSA is a padlock: Bob hands it out in advance, and anyone can lock a letter so that only Bob can open it.
| Question | Diffie–Hellman | RSA |
|---|---|---|
| What it does | Two people derive a shared secret key | Locks a letter for one recipient; signatures work the same way |
| Who has to take part | Both at once: each adds their own secret number | Only the sender: everyone already has Bob’s padlock, Bob himself may be offline |
| What travels over the channel | The public numbers A and B; the key itself never does | The locked letter c |
| How long the keys live | Fresh secret numbers for every conversation | One padlock for years |
| What it relies on | It is hard to find the secret number from the public one (discrete logarithm) | It is hard to split n into two primes |
| Analogy | Paints mixed by two people | An open padlock |
Russian certified cryptographic tools derive a shared key with the VKO algorithm. It is described in the standardization recommendations R 50.1.113-2016 and works on the 256- or 512-bit elliptic curves of the GOST R 34.10-2012 signature standard. The idea is the same as in the game: each side has a secret number and a public one computed from it; each combines its own secret with the other’s public number, and both end up with the same result.
It differs from the textbook scheme in two ways. A random number called UKM, sent in the open, is mixed into the calculation, so the same long-term keys yield a fresh shared key every time. And the result isn’t used directly: it is passed through the Streebog hash function (GOST R 34.11-2012). The finished key then encrypts data with Kuznyechik or Magma. VKO is also used in the Russian cipher suites for TLS.
In the Ludus Lab interactive demo you work through the whole protocol by hand on small numbers. Eve sees everything you see, so you can check where she lacks information and where she wins. Here’s what to try:
All three follow the same pattern: a secret number, a public number, a shared secret. What differs is the world in which the calculations happen:
| Parameter | Classic DH | ECDH (X25519) | VKO (GOST) |
|---|---|---|---|
| Where it computes | Remainders modulo a prime p | Points on Curve25519 | Points on GOST R 34.10-2012 curves |
| Number size | 2048–4096 bits | 255 bits | 256 or 512 bits |
| Security, roughly | ≈ 112 bits at 2048 | ≈ 128 bits | ≈ 128 or ≈ 256 bits |
| What happens to the shared secret | A key derivation function (HKDF in TLS) | A key derivation function (HKDF in TLS) | Streebog hash with the public UKM |
| Year | 1976 | 2006 (D. Bernstein) | 2016 |
| Standard | RFC 3526, RFC 7919 | RFC 7748 | R 50.1.113-2016 (RFC 7836) |
| Issued by | IETF | IETF | TC 26, Rosstandart |
Eve is smarter than plain brute force. For the discrete logarithm modulo p there is a clever method, the number field sieve. Because of it, a 2048-bit p gives roughly the security of a 112-bit symmetric key, nowhere near 2048 bits. On elliptic curves no such tricks are known: the best methods take on the order of the square root of a full search, so a 256-bit curve is enough for about 128 bits of security. Hence the move to curves: shorter keys, faster calculations.
In 2015 researchers demonstrated the Logjam attack. Many servers used the same standard 512- and 1024-bit primes, and some of them, under old “export” rules, would accept 512 bits. For a fixed p the heaviest part of the computation can be done once in advance, after which the keys of every connection using that p can be found quickly. For 512 bits that preparation took about a week; for 1024 bits it was estimated to be within reach of a nation state. After that, 1024-bit groups were retired: today p is at least 2048 bits, or curves are used instead.
A quantum computer running Shor’s algorithm would solve the discrete logarithm problem quickly, both modulo p and on elliptic curves. No such machines exist yet, but traffic recorded today could be decrypted later. That’s why, since 2024, browsers have been adding the post-quantum mechanism ML-KEM (the FIPS 203 standard) to X25519: the key is assembled from two parts, and to learn it an attacker would have to break both.
The powers of g modulo p should run through as many different remainders as possible. In the article’s example (g = 5, p = 23) they give all 22 numbers from 1 to 22: such a g is called a primitive root. But take g = 22 and the powers alternate: 22, 1, 22, 1… Then A can only be one of two numbers, and two tries are enough for Eve. That’s why the game only lets you choose “good” pairs of p and g.
A simplification: in real systems g is often not a primitive root but an element of a huge subgroup of prime order (for example, with p = 2q + 1 where q is also prime). What matters is not that the powers of g cover everything, but that there are astronomically many of them and no small subgroups through which Eve could get in.
Now you know how two people agree on a secret in public, and why that’s not enough if someone can interfere
In the demo you’ll mix paints, count powers on the lamp board, play as Eve and see where her attack fails and where it succeeds