The Replacement

Alice Uses E

Alice computes a valid DH result, but it is shared with Eve.

highlighted = computed this step

Alice computes from E

Alice raises the received value E=9 to her secret a=6.

96 mod 239^{6}\bmod{}23
Alice lands with EveUnauthenticated DH replacement values are recomputed from p, g, a, b, and Eve's exponent.Alice lands with Eve - E=9quantityvaluee (Eve secret)10E=g^e mod p9Eve-Alice secret3Alice computes E^a3Eve-Bob secret6Bob computes E^b6real A-B shared never forms2

Alice gets the first split secret

The result is 3. Alice thinks it is shared with Bob.

96 mod 23=39^{6}\bmod{}23=3
Alice lands with EveUnauthenticated DH replacement values are recomputed from p, g, a, b, and Eve's exponent.Alice lands with Eve - E=9quantityvaluee (Eve secret)10E=g^e mod p9Eve-Alice secret3Alice computes E^a3Eve-Bob secret6Bob computes E^b6real A-B shared never forms2

Eve can compute that same side

Eve uses Alice's public A=8 with e=10 and gets 3.

810 mod 23=38^{10}\bmod{}23=3
Alice lands with EveUnauthenticated DH replacement values are recomputed from p, g, a, b, and Eve's exponent.Alice lands with Eve - E=9quantityvaluee (Eve secret)10E=g^e mod p9Eve-Alice secret3Alice computes E^a3Eve-Bob secret6Bob computes E^b6real A-B shared never forms2

Summary

Alice and Eve now share 3, not the honest Alice-Bob value.

Alice side=3\text{Alice side}=3
Alice lands with EveUnauthenticated DH replacement values are recomputed from p, g, a, b, and Eve's exponent.Alice lands with Eve - E=9quantityvaluee (Eve secret)10E=g^e mod p9Eve-Alice secret3Alice computes E^a3Eve-Bob secret6Bob computes E^b6real A-B shared never forms2