Chapter 4: Public Key Cryptography:
Diffie-Hellman key-exchange protocol
(Week 6)
8
The Diffie-Hellman Key Exchange protocol
This was invented by Whitfield Diffie and Martin Hellman8 in 1976.
It is a method for creating a shared secret numeric key over an open channel with potential
eavesdroppers. The two protagonists don’t have any (real) control over what actual number
their secret key is. (The key will then be used in a symmetric key9 algorithm such as DES
and AES—see next week’s lectures).
Let G = (Z/pZ)∗ be the multiplicative elements mod p. It is a cyclic group of order p − 1.
Since it is cyclic, it has a generator g, which means
(Z/pZ)∗ = {g, g 2 , g 3 , . . . , g p−1 }.
Example. A generator for (Z/11Z)∗ is g = 2. We have
{2, 22 , 23 , 24 , 25 , 26 , 27 , 28 , 29 , 210 } = {2, 4, 8, 5, 10, 9, 7, 3, 6, 1}
which is all the invertible elements mod 11.
Remark. To say a number g is a primitive root modulo p is the same as saying g is a generator
for (Z/pZ)∗ .
The algorithm works as follows:
• Fix a prime p and a primitive root g. Publish these.
• Alice secretly chooses an exponent a, and sends A = g a (mod p) to Bob.
• Bob secretly chooses an exponent b and sends B = g b (mod p) to Alice.
• Alice and Bob now share a secret, K = g ab (mod p), since Bob can calculate K =
Ab = g ab and Alice can calculate K = B a = g ab but Eve only knows g a and g b .
• They use this key to seed a traditional symmetric cipher, like DES or AES etc.
The key to this protocol is that exponentiating numbers is easy, whereas taking discrete
logarithms is (believed to be) hard—at least for certain primes.
Definition. Given a generator of g and a number A ∈ (Z/pZ)∗ , we say that a is the discrete
log of A with respect to g modulo p, if A ≡ g a (mod p).
8
New directions in cryptography, IEEE Transactions on Information Theory 22 (1976), 644-654
A symmetric key algorithm is one where the same key is used to encode and decode. Asymptotic
algorithms, such as PKC, are where different keys are needed for encoding and decoding.
9
29
8 The Diffie-Hellman Key Exchange protocol
Diffie-Hellman
Example. Let p = 9967 (a prime) and g = 3 (a primitive root modulo 9967). Alice secretly
chooses 34 = (100010)2 = 25 + 21 , and works out
32
34
38
316
332
=9
= 92 = 81
= 812 = 6561
= 65612 = 43046721 ≡ 9215 (mod 9967)
≡ 92152 (mod 9967) = 84916225 ≡ 7352
(mod 9967)
so
334 = 332 × 32 ≡ 7352 × 9 ≡ 6366
(mod 9967)
She send 6366 to Bob.
Meanwhile, Bob secretely chooses 37 = 25 + 22 + 1, and, calculating the same table as Alice,
works out
337 = 332 × 34 × 3 ≡ 7352 × 81 × 3 ≡ 2443 (mod 9967)
and he sends 2443 to Alice.
Public
Alice 6366
Bob
2443
Secret
34
37
Alice now takes the number Bob sent her, 2443, and raises it to her secret number, 34, using
the fast exponentiation method. She obtains
k = 244334 ≡ 7782
(mod 9967)
Bob takes the number Alice sent him, 6366, and raises it to his secret number 37, and obtains
k = 636637 ≡ 7782
(mod 9967)
The two keys match!
Public
Alice 6366
Bob
2443
Secret
34
37
Shared
7782
7782
The reason this works is because Alice knows a and g b (sent to her from Bob). She calculates
(g b )a = g ab .
Whereas Bob knows b and g a (sent to him by Alice), and calculates (g a )b = g ab .
Remark. Given p = 9967 and g = 3, and knowing the number 6366, it is hard to find the x
such that 3x ≡ 6366 (mod 9967). Such an x is known as the discrete log of 6366 in base 3
modulo 9967. (In this case we know the discrete log equals 34).
30
Diffie-Hellman
8 The Diffie-Hellman Key Exchange protocol
Remark. Currently the only way known to decrypt such secrets is to find discrete logarithms,
in the sense of seeing Alice’s g a find her a. However, that might not be necessary. The “DiffieHellman-problem” or DHP is as follows: If you know g and p (which is public) and you can
find g a and g b (from tapping into telephone lines) can you find g ab without first finding a
and b?
Remark. Note that in this system Alice and Bob have no real control over what the shared
key will be. Therefore, this approach cannot be used to send messages.
Remark (Historical). Martin Hellman, in “An Overview of Public Key Cryptography” 50th
Anniversary Commemorative Issue (May 2002) of the IEEE Communications Magazine, said:
The system I called the ax1x2 system in this paper has since become known as
Diffie-Hellman key exchange. While that system was first described in a paper
by Diffie and me, it is a public key distribution system, a concept developed
by Merkle, and hence should be called “Diffie-Hellman-Merkle key exchange” if
names are to be associated with it. I hope this small pulpit might help in that
endeavor to recognize Merkles equal contribution to the invention of public key
cryptography. Space does not permit an explanation of the quirk of fate that
seems to have deprived Merkle of the credit he deserves, but a quirk it is.
8.1
ElGamal
This was invented in 1985 by Taher Elgamal. (His surname is all lowercase after the first
letter, but his cryptosystem traditionally has a capital G in the middle). It uses the same
technology as Diffie-Hellman, but allows Alice and Bob to exchange messages, rather then
just keys.
Assume the prime p and generator g are known.
• Alice wishes to send a message m to Bob. We will assume that the message is numeric
(else convert it to one) and satisfies 0 ≤ m < p (else break the message into smaller
pieces).
• Bob secretly chooses an exponent b, finds B ≡ g b (mod p) and sends B to Alice.
• Alice chooses an a and finds A = g a . She also finds t = B a m. She sends (t, A) to Bob.
• Bob finds t · A−b ≡ g ba m · (g a )−b ≡ m (mod p), and hence has Alice’s message.
Remark. Although not essential, it will be good if Bob’s b can be chosen coprime to p − 1.
This is because B = g b will then also be a primitive root mod p, and so B a can then take
any and every value in (Z/pZ)∗ with equal probability, and thus all the information in m is
lost in t = B a m.
If Alice sends two messages m1 and m2 , say, to Bob using the same a, and if Eve can find
the plaintext m1 somehow, then she can also decode the message to read m2 too. This is
31
8 The Diffie-Hellman Key Exchange protocol
Diffie-Hellman
because if Eve knows m1 then from t1 = m1 B a she can find B a . From that, knowing only
t2 = m2 B a she can find m2 = t2 (Ba )−1 .
Such a scenario isn’t as unlikely as it seems. For example, the first message might be a press
release still under embargo. Once the embargo has passed, Eve can find out m1 simply from
reading the papers.
The conclusion is that to increase the security of messages, Alice should use a different a for
each message sent. Therefore a is called an ephemeral key.
8.2
Equivalence between Diffie-Hellman and ElGamal
Clearly both these cryptosystems can be broken if one can find discrete logs. However, it
might be that a system could still be broken without actually being able to find discrete logs
in general. If one has a system that can break either ElGamal or Diffie-Hellman than one
can break the other.
Let M1 be a machine that solves the ElGamal problem, in the sense that its input is all the
available public data, and its output is the secret message, that is
M1 : (p, g, g a , g b , mg ab ) 7−→ m
then M1 (p, g, g a , g b , 1) = g −ab and inverting this mod p (possible using Euclid’s algorithm,
for example) solves the Diffie-Hellman problem, since K = g ab .
Similarly if M2 is a device that can solve a Diffie-Hellman problem, then it can be used to
solve ElGamal. That is, let
M2 : (p, q, g a , g b ) 7−→ g ab
then given g b (from Bob) and (t, g a ) (from Alice), use the machine to find K = g ab , find its
inverse (via Euclid’s algorithm) and calculate m = tK −1 .
8.3
Bit commitment with Diffie-Hellman
Suppose Alice and Bob wish to bet on the outcome of a coin toss, but without actually
meeting. Clearly Alice cannot toss the coin and have Bob call, for then Alice has the
opportunity to lie and say coin-toss was the opposite of Bob’s declaration. But equally,
Alice cannot tell Bob the outcome of the coin toss before he has called what he thinks it will
be, for then Bob can simply make his call be the result of the toss.
There exists a Diffie-Hellman-like approach which solves this problem, and means Alice
can toss the coin, and send the result to Bob in such a way that he cannot tell what the
outcome was and Alice is committed to the outcome. (This assumes Bob cannot find discrete
logarithms).
Alice and Bob agree the following protocol. The agree on a prime p and a generator g. Alice
will toss the coin, and will then choose a random a whose 7th bit is 1 if the toss was heads
and 0 if it was tails. She sends A ≡ g a (mod p) to Bob. Bob then declares to Alice his call
32
Diffie-Hellman
8 The Diffie-Hellman Key Exchange protocol
of heads or tails. Alice can then let him know if he has won or lost, and sends him a. Bob
can look at the 7th bit of a and check it really does equal 0 or 1 (depending on the coin toss
outcome Alice informed him of) and can check that g a really does equal A, so Alice cannot
cheat by changing the result after hearing Bob’s call.
This works because once A is fixed, Alice is fixed into her choice of a, and so is fixed into
the result of the coin toss. This method assumes Bob cannot deduce the 7th bit of a from
knowing g a , but this is a good assumption, because 7 is arbitrary (if you could find any
arbitrary bit of a knowing only A, you could find the discrete logarithm of A with respect
to g).
Remark. Choosing the least-significant bit of a to be the result of the coin toss is a bad idea,
because that can be found from knowing A. Note that a is even if and only if g a is the
square of ±g a/2 , which happens if and only if g a is a quadratic residue mod p. But checking
whether A is a quadratic residue mod p can be done easily using Legendre symbols.
8.4
Finding primitive roots modulo p
When p is a prime, a primitive root modulo p is a number whose powers yield every non-zero
number mod p.
Thus we see that g being a generator for (Z/pZ)∗ is equivalent to g being a primitive root
modulo p.
Primitive roots have two very useful properties:
Proposition. Let g be a primitive root mod p, and let n, j and k be integers. Then
• g n ≡ 1 (mod p) if and only if n ≡ 0 (mod p − 1).
• g j ≡ g k (mod p) if and only if j ≡ k (mod p − 1).
Proof. This was properly covered in Introduction to Number Theory. Here’s a sketch of the
proof. For the first bullet point assume that n ≡ 0 (mod p − 1), which means n = a(p − 1).
Then
a
g n ≡ g p−1 ≡ 1a ≡ 1 (mod p).
by Fermat’s Little Theorem. Conversely, assume that g n ≡ 1 (mod p) and write n =
a(p − 1) + r with 0 ≤ r < p − 1. Note that, by Fermat’s Little Theorem again,
1 ≡ g n ≡ g a(p−1) g r ≡ g r
(mod p).
Hence if r ≥ 1 we have
2 3
g, g , g , . . . , g r , g r+1 , g r+2 , . . . , g p−1 = g, g 2 , g 3 , . . . , g r , g 1 , g 2 , . . .
(here we used the fact that g r = 1). This is cyclic, repeating after every r terms, and thus
the set contains only r elements. This contradicts the assumption that g is a primitive root,
since its powers must yield every non-zero number mod p (of which there are p − 1 terms)
33
8 The Diffie-Hellman Key Exchange protocol
Diffie-Hellman
and this set has yielded only r terms. The only way for this not to be a contradiction is if
r = 0, which means (p − 1) | n or n ≡ 0 (mod p − 1).
For the second bullet point, note that g j ≡ j k =⇒ g j−k ≡ 1 and by the results of the first
bullet point, this happens if and only if j − k ≡ 0 (mod p − 1), so j ≡ k (mod p − 1).
Remark. Primitive roots are not unique.
Proposition. If g is a primitive root modulo p, then so is g x for any x coprime to p − 1.
Proof. A corollary of Fermat’s Little Theorem is that exponents work modulo p − 1. If x is
coprime to p − 1 then {x, 2x, 3x, . . . , (p − 1)x} ≡ {1, 2, 3, . . . , p − 1} (mod p − 1), which says
that multiplying by x mod p − 1 simply rearranges the set. (It is crucial x has an inverse
mod p − 1 for this statement to be true). Thus
g x , g 2x , g 3x , . . . , g (p−1)x ≡ g, g 2 , g 3 , . . . , g p−1 ≡ {1, 2, 3, . . . , p − 1}
(mod p)
and so g x is also a primitive root modulo p.
Corollary. For a given prime p, there are φ(p − 1) primitive roots modulo p.
Example. Assuming 2 is a primitive root modulo 13, find all the primitive roots mod 13.
Solution. The numbers coprime to 12 are 1,5,7, and 11. Since 2 is a primitive root mod 13,
and we have
25 ≡ 6
27 ≡ 11
211 ≡ 7
we see that the four primitive roots mod 13 are 2, 6, 7 and 11.
Now, if the prime factorization of p − 1 is known, one can quickly check a number to see if it
is a primitive root. I’ll demonstrate with an example of finding primitive roots modulo 13.
Note that 13 − 1 = 12 = 22 × 3.
Now every element of (Z/13Z)∗ has an order, which is the smallest k such that ak ≡ 1
(mod 13). This order divides the order of the group (12 in this case), so the possible orders
are 1, 2, 3, 4, 6, and 12. The following tables show which values equal 1.
order \ power 1 2 3 4 5
12
6
4
1
3
1
2
1
1
1
1 1 1 1 1
34
6
7 8
9
10
11
1
1
1
1
1 1 1 1
1
1
1
1
1
12
1
1
1
1
1
1
Diffie-Hellman
8 The Diffie-Hellman Key Exchange protocol
Note that every element which is not a primitive root (that is, every number which does not
have order 12) equals 1 when raised to a power of either 6(= 12/2) or 4(= 12/3).
Hence, if you wished to check whether 2 is a primitive root modulo 13, rather than raising
it to every power between 1 and 12 and ensuring they yield all possible numbers, one simply
needs to show that both 26 and 24 are not congruent to 1 mod 13 to conclude that its order
is 12, and hence 2 is a primitive root mod 13. We have
26 ≡ 12 6≡ 1 (mod 13)
24 ≡ 3 6≡ 1 (mod 13)
and so 2 is is a primitive root.
This method also shows that 3 is not a primitive root. To see this note that 36 ≡ 1 (mod 13).
Example. Show that 3 is a primitive root modulo 101.
Solution. Note that 100 = 22 × 52 and so we only need to check powers equal to 100/2 = 50
and 100/5 = 20. One can check that
350 ≡ 100 (mod 101)
320 ≡ 84 (mod 101)
and since neither of these are 1, we conclude that 3 is a primitive root mod 101.
The general algorithm is as follows: To find primitive roots modulo p, find the prime factors
of p − 1. Say it equals
p − 1 = q1a1 q2a2 · · · qkak
with qi all primes, and ai ≥ 1.
For the g you wish to test, simply evaluate g (p−1)/q1 , g (p−1)/q2 , . . . , g (p−1)/qk , and if they are
all not equal to 1, then g is a primitive root. If one of them equals 1, then that g is not a
primitive root. Simply chose another value of g to test.
35
8 The Diffie-Hellman Key Exchange protocol
36
Diffie-Hellman