The Transcript

Server Authentication

A toy certificate chain signs the server's DH share. The signature check is recomputed from small RSA values.

highlighted = computed this step

Why a certificate appears

The server needs more than a bare DH share. This toy leaf certificate is signed by the toy root.

root signs leaf\text{root signs leaf}
Toy certificate chainToy root-to-leaf certificate chain verified by exact RSA arithmetic.Toy certificate chain - root verifies leafToy Root CAn=55, e=3Leaf cert binds share 19digest=33, sig=22

Bind the server share

The leaf id 14 and server share 19 recompute digest 33.

14+19 mod 55=3314+19\bmod 55=33
Toy certificate chainToy root-to-leaf certificate chain verified by exact RSA arithmetic.Toy certificate chain - root verifies leafToy Root CAn=55, e=3Leaf cert binds share 19digest=33, sig=22

Verify the signature

Signature 22 raised to root exponent 3 modulo 55 gives the same digest 33.

223 mod 55=3322^{3}\bmod 55=33
Verify toy certificateToy RSA verification recomputed from signature, exponent, and modulus.Verify toy certificate - 22^3 mod 55stepbitpriorsquaremultiplyresult011122221122443333

Summary

The toy root verifies the toy leaf and binds the server share. NOTE: toy-modulus; no-padding; no-side-channel; no-production; never-roll-your-own. Toy transcript only: not real TLS bytes, not real certificate validation, no AEAD record protection, and no security-size claims.

certificate binds share\text{certificate binds share}
Toy certificate chainToy root-to-leaf certificate chain verified by exact RSA arithmetic.Toy certificate chain - root verifies leafToy Root CAn=55, e=3Leaf cert binds share 19digest=33, sig=22