The Secret You Can Say Out Loud

Two people who have never met, who share no secret, need to agree on one: a private key for a locked conversation. And they have to do it out loud, in a room where you are standing, writing down every word. It sounds impossible, because whatever they say to reach a shared secret, you hear it too. Yet it can be done, and the whole of secure internet traffic depends on it. Below is a real, working version of the trick (Diffie-Hellman, 1976), shrunk to toy size so you can watch the secret form, try to steal it, and meet the one attack it does not stop.

The move rests on a single lopsided piece of arithmetic, something easy to do forwards and brutally hard to undo. Raising a number to a power modulo a prime is fast; working backwards from the answer to the power, the discrete logarithm, has no known shortcut. Alice and Bob each do the easy direction once; an eavesdropper is left facing the hard one. Don't take that on faith. Build the secret, then try to break it yourself and watch the difficulty climb.

1. Build a shared secret, in public

Everyone agrees on two public numbers: a prime p and a base g. Alice picks a secret number a she tells no one; Bob picks his own secret b. Each sends the other g raised to their secret, mod p, and those two values travel across the open channel, in full view. Then each raises what they received to their own secret. Watch what comes out.

Both sides landed on the same number, by different routes: Alice raised Bob's value to a, Bob raised Alice's to b, and both are really gab mod p, the exponents multiplied, in whichever order. That shared number is the secret key. Eve heard p, g, A = ga and B = gb, every one of them, and to reach gab she would need one of the private exponents. She would have to run a power backwards.

2. Now try to steal it

You are Eve. You have the current p, g, A, B above and nothing else. To recover the secret you must solve a discrete logarithm: find the exponent a with ga = A (mod p). For a toy prime you can. The fastest simple method is baby-step giant-step, which does about √p steps instead of p. Here it is, running for real:

It falls in a blink, because √p for a toy prime is tiny. The security is entirely in the size of that square root. Double the bit-length of p and you square p, so √p, the work, itself doubles in bit-length. The table is honest about how fast the wall becomes unclimbable, and about a sharper attack than the one above:

3. The attack it does not stop

Here is what the paint-mixing pictures never tell you. Diffie-Hellman defeats a passive listener, someone who only reads the wire. It does nothing against an active attacker who can also change what crosses it. Meet Mallory, sitting in the middle. She lets no message through untouched: to Bob she pretends to be Alice, to Alice she pretends to be Bob, and runs two handshakes at once.

With Mallory off, the message is just a locked number on the wire and she learns nothing. Switch her on and the two green “shared” keys quietly become different numbers, one she shares with Alice, one she shares with Bob, and she reads and relays everything, invisible to both. Diffie-Hellman handed each of them a private line to someone. It never promised that someone was who they thought. That missing guarantee is authentication, proof of who is on the other end, and it is a separate job. It is the reason the exchange in a real secure connection is signed: the server proves its identity with a certificate, so a forged gb is caught. Secrecy without authentication is exactly this trap.

Four things worth getting straight