Two parties run Diffie-Hellman over a prime field with g = 5, p = 23, private values a = 6 and b = 15. Compute both public values and the shared secret. Then state what an active attacker in the middle achieves and why the arithmetic gives no defence.

Two parties run Diffie-Hellman over a prime field with g = 5, p = 23, private values a = 6 and b = 15. Compute both public values and the shared secret. Then state what an active attacker in the middle achieves and why the arithmetic gives no defence.

Approach: Exponentiate g by each private value modulo p, then raise each received public value by the other private value and check the two agree.

2. A = 5^6 mod 23: 5^2 = 25 ≡ 2, so 5^4 ≡ 4 and 5^6 = 5^4 * 5^2 ≡ 4 * 2 = 8, so A = 8. B = 5^15 mod 23: 5^8 ≡ 4^2 = 16, so 5^15 = 5^8 * 5^4 * 5^2 * 5 ≡ 16 * 4 * 2 * 5 = 640, and 640 = 27 * 23 + 19, so B = 19. The shared secret is B^a = 19^6 mod 23 and A^b = 8^15 mod 23, both equal to 2: 19 ≡ -4, so 19^2 ≡ 16, 19^4 ≡ 16^2 = 256 ≡ 3, and 19^6 ≡ 3 * 16 = 48 ≡ 2. An active attacker in the middle runs two separate exchanges, one with each party, choosing their own private value for each, so each side derives a shared secret with the attacker while believing it is shared with the other. The attacker decrypts, reads or edits, and re-encrypts on the other leg. Diffie-Hellman gives no defence because the arithmetic proves only that the party at the other end knows a discrete logarithm, never which party that is. The fix is authentication of the public values, by signing them with a long-term key whose certificate chains to a trusted root, or by a pre-shared key, which is exactly what a TLS handshake adds on top of the exchange.

Follow-up: The attacker cannot modify traffic but records everything and steals the long-term signing key a year later. What does forward secrecy give you here and what must be discarded to get it?

Key concepts: diffie-hellman, shared secret, man in the middle, authentication.