Saramsha

No. 017  ·  3 October 2026

A Secret Nobody Sent

Alice and Bob have never met and have no safe way to talk. Everything they say crosses a wire that a stranger is listening to. By the end of four messages, all of them public, the two of them hold the same secret and the stranger does not. Change either secret and watch it happen again.

Alicehers alone

Bobhis alone

The open channel — everything here is overheard

Eve, who has heard every word

About this piece

Agreeing on a secret in public

Every code needs a key, and for about three thousand years the key had to be carried. Spartan officers were issued a wooden rod cut to the same diameter as their general's. Embassies moved codebooks in diplomatic bags. Through the 1960s and 1970s banks shipped keys around the world by courier, by hand, at enormous cost, because the one thing everybody knew about secret writing was that the two ends had to meet first. The requirement looked less like a difficulty than like a law of nature: you cannot agree on a secret over a channel someone is listening to, because whatever you say to agree on it, they hear too.

In November 1976 Whitfield Diffie and Martin Hellman published New Directions in Cryptography, which opens by announcing that the reader is standing at the edge of a revolution, and then earns the sentence. The protocol on this page is in it. The idea had been circling for a couple of years: Ralph Merkle, as a Berkeley undergraduate, had already shown that two people could agree on a secret in public by trading a mountain of puzzles, which worked but cost the eavesdropper only the square of what it cost the participants. Hellman has said ever since that the thing should be called Diffie–Hellman–Merkle. Diffie and Hellman took the Turing Award for it in 2015.

What makes it possible is a sum that is easy in one direction and hopeless in the other. Pick a prime p and a number g. Raising g to a power and taking the remainder mod p is quick: even for a 617-digit prime a computer does it in well under a millisecond. Going the other way — being handed the answer and asked which power produced it — is the discrete logarithm problem, and after fifty years of attention nobody has a fast way to do it. Taking the remainder is what destroys the trail. Over ordinary numbers, powers of 5 climb in an orderly line and a bigger answer means a bigger exponent. Mod 23 they go 5, 2, 10, 4, 20, 8, 17, 16 … and the size of the answer tells you nothing whatever about the exponent. Switch this page to Numbers and step the slider to watch that scramble happen.

The protocol is then four lines. Alice and Bob agree, out loud, on p and g. Alice picks a secret number a and sends A = ga mod p. Bob picks b and sends B = gb mod p. Alice computes Ba mod p and Bob computes Ab mod p — and those are the same number, because one of them is (gb)a and the other is (ga)b, and both are gab. The whole trick is that exponents commute. The shared key is gab mod p, a number neither of them ever sent, and which in that form neither of them even calculated.

Eve has p, g, A and B, and wants gab. Getting it from those four is called the computational Diffie–Hellman problem, and the only approach anyone knows is to extract a or b first — a discrete logarithm. The button on this page runs the dumbest possible version, trying every exponent in turn, and against the 5-bit prime it wins in about ten guesses, which is the honest demonstration of why toy numbers are toys. But brute force is not the state of the art. Baby-step giant-step and Pollard's rho both finish in roughly √p steps, so the 31-bit prime here really costs about 46,000 operations rather than two billion, and index-calculus methods do far better still. The largest discrete logarithm ever computed in a prime field of this kind was 795 bits, in December 2019, by a team that burned roughly 3,100 core-years on it. Real deployments use 2048 bits and up, and the gap between 795 and 2048 is not a factor of three. It is a wall.

The paint is the usual way of explaining this, and it is a good analogy because it gets the shape exactly right: mixing is easy, unmixing is not, and it does not matter which order you add the pigments in, so the two jars end up identical. It is a bad analogy in one specific way, which this page lets you perform. There are twelve paints. Eve can simply mix the base with each of them in turn and see which one matches what Alice sent — eleven mixes at the outside, and no mathematics at all. One-wayness alone buys you nothing; what buys you security is one-wayness over a space too large to walk through. That is the entire argument for the length of the numbers.

There is a second thing the exchange does not do, and it has caused more real-world damage than any weakness in the mathematics: it does not tell you who you are talking to. Eve can stop being a listener and become a relay — run one exchange with Alice while pretending to be Bob, another with Bob while pretending to be Alice, and sit in the middle re-encrypting everything with two perfectly good keys. Diffie–Hellman gives you a secret shared with somebody. Establishing that the somebody is the right one needs an outside anchor, which is what certificates, signatures and the whole business of certificate authorities are for. The protocol is secure against a stranger who listens and useless against one who interferes.

What it buys in exchange is worth the trouble. Because a and b are cheap to generate, they can be thrown away after one conversation — the ephemeral mode, written DHE or ECDHE in a browser's connection details. Record a year of somebody's encrypted traffic, break into the server afterwards and steal every key on it, and you still cannot read what you recorded, because the keys that encrypted it were deleted when each session ended. This is forward secrecy, and TLS 1.3 made it compulsory by removing the alternative.

Not all of the history is reassuring. Export rules from the 1990s left a lot of servers willing to fall back to 512-bit primes; in 2015 the Logjam attack showed you could force that downgrade and then break the exchange, and the same paper pointed out that because so much of the internet shared a handful of fixed 1024-bit primes, one enormous precomputation against a single prime would unlock millions of connections — an expense an intelligence agency could meet. The lesson was that the numbers must be big and preferably not everybody's. Today's default is a different group altogether: elliptic curves, where the hard problem is the same shape but the keys are 32 bytes instead of 256, and X25519 does the job in a fraction of the time. The algebra underneath is still the four lines above.

One last historical footnote, declassified in 1997. James Ellis, at GCHQ, had argued that secure communication without a shared secret was possible in 1969. Clifford Cocks found what we now call RSA in 1973, and Malcolm Williamson found this key exchange in 1974, two years before Diffie and Hellman. None of it could be published, so none of it existed, and the three of them watched other people's names go on their work.

Everything runs in your browser and nothing is uploaded; Eve's search is a loop in the same tab. The paint mixes by the geometric mean of the pigment colours, which is the cheap standard model of subtractive mixing — and, conveniently, depends only on which pigments went in, not the order. The address bar sets the state: ?mode=numbers, ?bits=24, ?a=6&b=15 for the two secrets, ?warm=1 to skip the opening animation, ?eve=1 to set the eavesdropper going straight away. Keys: R runs the exchange again, E sets Eve going, M switches paint and numbers, 1–4 jump to a step.