Attack the Toy

Why Real DH Needs More

The toy exchange is deliberately breakable. Real DH needs large groups, authentication, and protocol checks around the arithmetic.

highlighted = computed this step

Why real DH needs more

The toy exchange has two separate failures: the group is tiny, and the public values are unauthenticated. Real deployments must fix both.

large group plus authentication\text{large group plus authentication}
Tiny group attackDiscrete log rows are recomputed until the target public value appears.Tiny group attack - recovered=6quantityvaluek=15k=22k=310k=44k=520k=6 recovered8

Large groups stop the toy search

The toy table recovers a=6 by brute force. Real DH uses groups with at least 2048 bits so this table is not feasible.

real groups≥2048 bits\text{real groups}\ge2048\text{ bits}
Tiny group attackDiscrete log rows are recomputed until the target public value appears.Tiny group attack - recovered=6quantityvaluek=15k=22k=310k=44k=520k=6 recovered8

Authentication stops the replacement

The MitM table shows Alice ending at 3 while Bob ends at 6. TLS prevents this by authenticating the exchange with certificates.

3≠63\ne6
Authentication failureUnauthenticated DH attack values recomputed from Eve's injected exponent.Authentication failure - E=9quantityvaluee (Eve secret)10E=g^e mod p9Eve-Alice secret3Alice computes E^a3Eve-Bob secret6Bob computes E^b6real A-B shared never forms2

Do not roll your own

Diffie-Hellman is only one arithmetic ingredient. NOTE: toy-modulus; no-side-channel; no-production; never-roll-your-own. Protocol authentication, transcript binding, validation, and side-channel defenses are part of the deployed design.

use reviewed protocols\text{use reviewed protocols}
Authentication failureUnauthenticated DH attack values recomputed from Eve's injected exponent.Authentication failure - E=9quantityvaluee (Eve secret)10E=g^e mod p9Eve-Alice secret3Alice computes E^a3Eve-Bob secret6Bob computes E^b6real A-B shared never forms2

Summary

Toy DH is checkable and breakable; real DH needs large groups and authentication. NOTE: toy-modulus; no-side-channel; no-production; never-roll-your-own. Exact arithmetic on a deliberately tiny toy modulus; real DH uses 2048+ bit groups inside authenticated reviewed protocols.

large authenticated DH only\text{large authenticated DH only}
Authentication failureUnauthenticated DH attack values recomputed from Eve's injected exponent.Authentication failure - E=9quantityvaluee (Eve secret)10E=g^e mod p9Eve-Alice secret3Alice computes E^a3Eve-Bob secret6Bob computes E^b6real A-B shared never forms2