Diffie Hellman -the Mathematics bit- Computerphile

Correction : as oodles of commenters have pointed out, the clock face should go from 0 to n-1. Also, worth reminding people that Mike has simplified the notation in this video (as he mentions).
Mike explains the mathematics behind one of the most important pieces of computer security. (Simplified version with colour mixing analogy linked below)
Secret key Exchange (Colour Mixing) Video: • Secret Key Exchange (D...
/ computerphile
/ computer_phile
This video was filmed and edited by Sean Riley.
Computer Science at the University of Nottingham: bit.ly/nottscomputer
Computerphile is a sister project to Brady Haran's Numberphile. More at www.bradyharan.com

[@qm3ster]

I think the fact that addition, multiplication, and exponentiation maintain their properties under modulo arithmetics was worth mentioning.

[@znefas]

could you please link an explanation to this? i've been trying to understand how g^a and g^b were made public when in actuality it was those numbers _mod n_ that were made public. also don't understand how you can calculate (g^a)b mod n without first having g^a, which again, wasn't made public because of the modulo term

[@qm3ster]

@@znefas I never saw an explanation myself, but consider the following: imagine we are working in base N, and not binary or decimal. Then, modN just keeps the last digit. So, since we know that it's possible to start by calculating the last digit when doing long addition/multiplication, as the carry only travels left, we can discard the left digits at any intermediate steps and still have the same result as if we only did it at the end. Signed addition and negative powers (division) break this, but wrapping subtraction of unsigned integers actually survives afaik. This is the same reason why we can know the last digit of 7^44444 will be 1, without having to calculate the whole number.

[@znefas]

@@qm3ster the only thing i understood is how the carry only traveling left may be useful when trying to calculate a number smaller than the entire expression; i don't understand how the whole mod N thing works i also hate modular arithmetic notation because "13 = 5 mod 8" is so much more annoying than "13 % 8 = 5" for me as a programmer

[@qm3ster]

​@@znefas for all unsigned integers a, b, c, n: (a + b)%n == (a%n + b%n)%n (a * b)%n == ((a%n)*(b%n))%n ((a ^ b) ^c)%n == (((a%n)^b)%n)^c)%n As long as at the end you were dropping the stuff left of n, the result won't be changed by dropping it earlier, as it cannot affect what is on the right. The intermediate values will in fact be different, which is what makes this a computational saving. But outside cryptography and adjacent subjects like checksumming you usually want the most significant bits, not the least significant, they're called that for a reason, so this doesn't get used *too* often.

[@wybird666]

@@znefas g^a and g^b wasn't made public, only g^a%n and g^b%n - Mike got a bit sloppy when presenting (just as we do when we write down the maths). If we knew g^a, and since we know g, it would be trivial to work out a (and similarly for b).

[@peter62709]

I just took a crypto class in university and my professor got so wrapped up in the specifics of group theory that I didn't even understand how Diffie-Hellman worked, but this made everything so clear without really being any less mathematical.

[@kusharora1435]

love the way this guy explains.. never imagined i could binge watch cryptography videos

[@Ry____]

It’s amazing how beautifully elegant and simple cryptography really is.

[@babel_]

Alice and Bob only communicate in Pub. Alice and Bob are probably undergrads.

[@fsmoura]

5:02 THIS! IS! CRYPTOGRAPHY! *_*kicks you down a 4096-bit deep well*_*

[@raphaelabreu6757]

Great clock analogy. This should be the main video

[@F1ghteR41]

A Parker clock, one might say!

[@AndersJackson]

It should not, as they used the colour analogy there.

[@mungflesh199]

The clock is not strictly an analogy, it's a common learning technique for modular arithmetic

[@Cysecsg]

It explains why n needs to be a big value.

[@skeetabomb]

The clock analogy I think is one of the best ways to explain modulo arithmetic...

[@YouTubist666]

Wow. I've always thought D-H was some esoteric math magic. It is extremely clever and elegant.

[@MrHaggyy]

There is quite some math behind it about rings, fields and other group theory. But the plain formulas in crypto are pretty nice and easy. The computation is quite a mess as numbers get pretty big, often even bigger than your memory and power and multiply are not the chips best friend.

[@Tasarran]

I find there are a lot of these types of algorithms; Radix Sort comes to mind... It seems like voodoo, then you look at the algorithm, and probably at first think 'that can't possibly work...?' but viola...

[@justalonelypoteto]

​@@MrHaggyythat's still somewhat elegant, square-multiply-modulo is a genius and simple solution to easily calculate such an otherwise gargantuant number. I find the truly hard (and amazing) part is the theory behind which numbers are safe to use, even more fascinatingly and terrifyingly genius are the ways people find to crack it

[@MrHaggyy]

@@justalonelypoteto square-multiply is a genius algorithm as it has view operations,. Lattice and Russian Peasant are awesome too. A lot more operations but most of them are cheap additions that can be done in parallel. My interest is hard-realtime systems. We want algorithms with fixed calculation times. Square-multiply can vary depending on the numbers. And on cheap and small hardware you might be able to eavedrop with an oscilloscope.

[@justalonelypoteto]

@@MrHaggyy Montgomery's ladder might be up your alley, it performs both operations each time with the only distinguishable difference being a possible timing variation because the needed operation affects which memory address is read, apparently this is fixed by scattering the data around to ensure cache misses

[@xcvsdxvsx]

I actually understood the math for once!

[@peppybocan]

yeah, modular arithmetics is easy. :D ...

[@jasonpatowsky6929]

And theeeeres the party pooper.

[@BryanLeeWilliams]

Didn't work for me a=11 b=13 g=7 n=199

[@grrr1351]

The math is easier to understand, because it's more technical.

[@musashi939]

Jyoti Das lol.

[@Kolop315]

Wow, that is way more simple than I was expecting.

[@outofahat9363]

Came in expecting some incomprehensible esoteric math but this was very easy to understand. Reminds me of that Doctor Strange quote "It's a simple spell but quite unbreakable"

[@mackmenezes4912]

If you watched Attack on Titan ,one of the character used. Only his words and hacked the entire cosmos to make it seem real at that moment

[@VoilaTadaOfficial]

I love these math versions. They help me understand it so much better than just the computer science bits. Please do more of these!

[@kennethcarvalho3684]

For some reason I understand all his videos but not many of the other tutors on Comphile.. Quite a teacher

[@Syldar]

This is the most interesting channel about computer science. I’ll never be as much grateful as I would like to be. Thanks a lot for sharing these.

[@drewdaniels9577]

All these years of hearing how "diffie helman is extremely complex" yet such a simple and easily understandable algorithm. Thank you so much for this!

[@trevordobbertin6469]

It would be awesome if you guys did some podcasts. I learn so much from you guys and it would be great to listen while in the car or at school. Thanks guys.

[@wildwest1832]

The idea of diffie hellman is actually really clever. Its actually pretty hard to come up with a way to do that, and not have anyone be able to reverse how they did it or needing to share something that can be reversed. I can see why we still use this today it would be very difficult to replace it, and its very ingenious how it works and its not incredibly complicated either.

[@edsonrocks]

This is the best explanation I've ever found about it. Incredible concise and very illustrative. Thank you guys.

[@nomad_geek]

This is the video I've been waiting for! Thanks Guys, awesome job!

[@flockenlp1]

You are why I am confident I won't fail my Safety and Security module. Mike is exceptional at communicating these concepts!

[@desiassassin3268]

This made so much sense and was super easy to grasp. Mike pound really is a great teacher. Also props to Diffie Hellman for creating such an easy but quite unbreakable algorithm.

[@bariswheel]

Great explanations folks, keep pumping these videos out!

[@KraylusGames]

Lmao everyone calling him out for not stopping at n-1. Give the dude a break!

[@tohopes]

☞ nope.avi

[@tedbaltz2164]

they need to feel smart

[@martinkunev9911]

If you're not familiar with what he's explaining, this is enough to confuse you and this is not the only thing he says that can create confusion.

[@realcryptc]

he kinda of implicitly stopped at n-1 when he mentioned there is the element 0 in mod operations

[@skeetabomb]

😂

[@johnpugh24]

Thanks for explaining, you do such a great job. Always my favourite computerphile presenter.

[@nalbertcerqueira6079]

The simplicity of this algorithm is so amazing!

[@emilmartens123]

awesome video, I see some comments point out its actually (((g^a) mod n) ^ g)) mod n, so here is why its the same as (g^a)^b mod n: lets say: g^a = k*n+x where x is an unknown number because: (u + v) mod n =(u mod n + v mod n) mod n and because: k*n mod n = 0 we get: (g^a) mod n = (k*n+x) mod n = x ((g^a) mod n)^b mod n = x^b mod n i used the binomial theorem nCr to get: (g^a)^b = (k*n+x)^b = (k*n)^b + (nC1)*(k*n)^(b-1)*x + ... + (nC(b-1))*( (k*n)^(1)*x^(b-1) + x^b since n appears in every part except in x^b every other part is set to 0 when we take the modulo: (g^a)^b mod n = x^b mod n so therefore (g^a)^b mod n = ((g^a) mod n)^b mod n

[@AhsimNreiziev]

Yup.

[@theguyoo1]

Thanks for this, felt like a logical leap without this proof.

[@nelsblair2667]

At the beginning there, did you put a g, where you meant a b?

[@AhsimNreiziev]

@@nelsblair2667 He did, yes.

[@deckard5pegasus673]

Interesting proof. But a few corrections: First what you are trying to prove is that (g^a)^b mod n == (g^a mod n)^b You made a mistake, in (((g^a) mod n) ^ g)) mod n . You put an extra "g", it's a "b" Also to simplify...or clarify your proof, and make it more understandable, organized: 1) supposing: g^a = n*k+x ( *WHERE "x" IS NOT A MULTIPLE OF "n"* , in other words "x" is the "remainder" of the division by "n" ) This is an important purposeful "setting up" so that: n*k mod n == 0 and x mod n == x 2) mod n of any number which is a multiple of n will equal zero --> n*k mod n == 0 3) Proof that: (g^a mod n)^b == x^b a) Which would mean --> (g^a mod n) == x a) substitute "n*k+x" for "g^a", from step "1" (n*k + x) mod n == x --> given that: n*k mod n == 0 (any multiple of "n" will be zero) b) If (n*k + x) mod n == x, then (g^a mod n) == x, c) meaning --> (g^a mod n)^b == x^b 4) (g^a)^b mod n a) substitute (n*k+x) for g^a, given in step "1" --> (n*k+x)^b mod n b) Expanding (n*k+x)^b, using binomial theorem, *IMPORTANT MAGIC* : *all terms will be multiples of "n"* except the last term which is x^b c) Mod n of all terms that are multiples of "n" will be zero, leaving only the last term: x^b d) Thus (g^a)^b mod n = x^b 5) (g^a)^b mod n == (g^a mod n)^b , as both equal to x^b .

[@ianpatrick23]

Fantastic explanation of the mathematics behind this encryption!

[@abhinavsixfaces]

Watched both videos. Beautifully explained.

[@vladpuha]

thank you for putting this video up. Such a good teacher and elegant explanation of public private key at its core. There are 100s of videos super complicated.. this is very nice, one can implement themselves right off the this video..

[@Starfuchs]

The clockface only goes up to n-1, (n mod n = 0). He forgot to change that too when he added the zero afterwards

[@kpan]

Thomas Wigele Yeah I came down to point it out as well :)

[@666Tomato666]

not only that, but the primality of g is completely irrelevant - the n needs to be prime if you want the n in the 2 to 4k range (and DH to remain secure), best if n is actually a safe prime (then g can be any number but 0, 1 and n-1) - a prime for which (n-1)/2 is also prime

[@kpan]

666Tomato666 I don't get why n would have to be prime at all?

[@aleksandarsavev]

+Π. Καράπας This way you are 100% sure that the remainder is in [0, n-1].

[@kpan]

Александър Савев but doesn't modulo always return something in the range of [0,n-1]?

[@karimbarakat7732]

Thank you so very much for these videos. I find them invaluable in understanding the ins and outs of cryptography.

[@Inritus618]

That really is a beautiful solution to exchanging keys. I really love that. Fantastic video as always!

[@AdamMPick]

The whole time I am thinking about the clock-drawing test, after seeing those clockface numbers beeing squished together. PS. I find this video even simpler to understand than the original "simple" version with the food colouring.

[@kayinnasaki]

Same. With the color one I was like "what do you mean I can't figure out what the other color was? We just subtract the public color from it!"

[@lambertbrother1628]

The actual process is more difficult as instead of adding, it's multiplication to the power of another colour. Imagine Yellow^red x blue.

[@xcvsdxvsx]

Me too. It's so easy to understand math when it doesn't have weird symbols that I have no idea what the heck they mean.

[@AndersJackson]

Yes, the thing with math is that it is a language which you need to learn. Once you do, the concepts behind the maths become not that complicated, when you know them. Implementation could still be complicated though. Devils in the details...

[@Pilbaran00b]

It's beautiful how simple and elegant it is.

[@macigli]

I really loved this vid. Great work guys!

[@xZise]

It looks really simple, but it unfortunately doesn't explain whether "(g^a mod n)^b" and "(g^a)^b mod n" are the same. I mean obviously it must be the same for it to work.

[@bgroks1]

Fabian Neundorf (g^a mod n)^b mod n is the same as (g^a)^b mod n, I believe he also mentioned it briefly in the video.

[@jonathanseamon9864]

The simple answer as to why they're the same is that Modulo arithmetic=Finite fields, and Finite fields are consistent. Proving that finite fields are consistent would probably be another couple videos...

[@TheUnclepecos]

Short answer: It's because the product in modulo/clock arithmetic is defined that way. If you wanna know more I'll explain it in more detail: Maybe it's easier if you think of g^a mod n just as a number between 0 and n-1 (actually if we use this notation we should start from 1 and go up to n-1, but it's not extremely important so let's forget about it). Think of the multiplication between two such numbers as a standard multiplication, but if the result is bigger than n-1 we take the remainder. So basically the product is just: (a mod n)*(b mod n) = a*b mod n (THIS IS THE DEFINITION OF PRODUCT IN MODULO ARITHMETIC) Elevating g to the power a is just repeated multiplication, so what you do is apply the definition of product: (g mod n)^a = (g mod n)*(g mod n)*...*(g mod n) = g*g*g*...*g mod n You can easly see that we get a similar thing if we elevate g^a to the power b: (g^a mod n)*(g^a mod n)*...*(g^a mod n) = (g^a)*(g^a)*...*(g^a) mod n = (g^a)^b mod n So yeah, (g^a mod n)^b = (g^a)^b mod n Hope it's clear now ;)

[@FelkCraft]

The "mod n" isn't an operation in this case. Appending "mod n" to a term just signals that you're calculating in clock arithmetic, meaning you always stay between 0 and n-1. If you do 2+3 in "mod 4", the answer is 5, or 1, or even 9, because in "mod 4" 1 is equal to 5 by definition. Calculating a modulo is not an operation that needs to be performed if you define yourself to be working in clock arithmetic

[@danieljensen2626]

Actually g^(ab) mod n = (g^a mod n)^ b mod n, but yes, it is the same. The proof is just long and kinda gross which is why he didn't get into it. Here it is if you want to see it though. Proof: Any number m mod n is defined as the remainder left after dividing m by n, so we have m=q*n+r where q is the whole number of times n goes into m, and m mod n=r, which is the remainder. So g^a=q_a*n+r_a, and g^a mod n=r_a. (I'm using the underscore to denote a subscript.) (g^a mod n)^b=r_a^b=q_1*n+r_1, and (g^a mod n)^b mod n=r_1. g^(a*b)=q_(ab)*n+r_(ab), and g^(a*b) mod n =r_(ab). But we also know g^(a*b)=(g^a)^b, and g^a=q_a*n+r_a, so g^(a*b)=(q_a*n+r_a)^b. Expanding that out into a sum we get (q_a*n+r_a)^b=sum((q_a*n)^(b-j)*r_a^j,j=0..b) The last term in this sum is r_a^b and every other term has at least one factor of n, so we can rewrite it as (q_a*n+r_a)^b=n*sum(q_a^(b-j)*n^(b-j-1)*r_a^j , j=0..b-1)+r_a^b. Now let q_2=sum(q_a^(b-j)*n^(b-j-1)*r_a^j , j=0..b-1), so we have (q_a*n+r_a)^b=q_2*n+r_a^b. Remember that this is equal to g^(a*b). So we have g^(a*b)=q_2*n+r_a^b. We already have r_a^b=q_1*n+r_1, so we have g^(a*b)=(q_1+q_2)*n+r_1 and g^(a*b) mod n = r_1. We already had that (g^a mod n)^b mod n = r_1 so we have now proved that g^(a*b) mod n = (g^a mod n)^b mod n.

[@hassananwer3674]

beautifully explained!!! I love this channel. Thank you!

[@allien5329]

beautiful and simplified explanation

[@SarveshParakh]

After watching all three videos, its much easier to understand and glad you used 'n' here that you didn't use in the last video with colors. This was an amazing series but if you label them as part of a series or make 1 full video combining all three or the first and last video, more viewers might decide to stick to the end. Anyway, Thanks a lot for this.

[@CJBurkey]

Wouldn't a mod n only return values from 0 to _n_-1? You wrote _n_ on the clock.

[@seraphina985]

Correct that was an error on their part since of course if a divides by n exactly the remainder is 0 not n.

[@VoilaTadaOfficial]

Technically you could have n on the clock but you'd have to omit 0. You can have n or you can have 0, but not both. Having n on the clock would actually be more like counting units of 1 up to n and then starting back at 1 again for the next unit until you run out of units. Same result (specifically in this case because the number itself doesn't matter), but a different perspective on it.

[@Friek555]

Having a 0 instead of the n is very useful when you work with such a construct though. This clock face is what mathematicians call a cyclic group, and its "neutral element" is 0 (or n, they are the same in the cyclical group). That means that (a+0)mod n=a mod n, so the 0 doesn't change an element by being added. That is very obvious if you actually write it as a 0 instead of an n.

[@AndersJackson]

And multiply by zero also give nice properties. :-)

[@tohopes]

But clocks are 1-based.

[@abigicic]

This is a really nice explanation and thank you for talking about it. I wish you talked a bit about man in the middle weakness and the ElGamal improvement.

[@SteveMacSticky]

Your videos are excellent. Thank you very much guys.

[@DimMyPrp]

Yeah! Best explanation on key exchange ever. Thanks to both videos I understood it instantaneously. A test on paper and mental arithmetic worked like a charm. Thanks :-)

[@nauthic3p0]

I like the videos with that guy, he knows his stuff and knows how to explain it!

[@mladenkaorlic]

Amazing explanation with the circle!

[@rutvaydhami367]

Absolutely amazing explanation! Keep it up

[@kegelsknight]

It shouldn't be 'n' on the clock but 'n-1' because 'n'==0 in modolo

[@sebastianheinrich8683]

I'm not the only one who is botherd by this ^^

[@AhsimNreiziev]

This is very true. Easy mistake to make, though.

[@Majenga]

same thought here - was about to write a comment.

[@remuladgryta]

There are 3 hard things in programming: 1 off by one errors and 2 naming things

[@breadnoodle]

I was about to write the same xd

[@davidsanders9426]

I thought "solving the discrete log problem" was what happens when you clog the toilet at your in-laws' house? ...Sorry, I'll show myself out.

[@Ping727]

...yeah you should really log off

[@ivanarabome4172]

You didn’t get the video.... tbh he actually did explain it well

[@jamhamtime1878]

@@ivanarabome4172 and you didn't get the joke

[@jadielrhys3156]

@Jesse Duncan yup, been watching on instaflixxer for since november myself =)

[@RussTeeTrombone]

Nice

[@xdyps]

Please do a video on Elliptic-curve cryptography and Elliptic-curve Diffie-Hellman , pretty please :D

[@sammonger4002]

It's interesting that he doesn't mention that n should be prime in addition of being large. That is an aspect equally as important as its size which could easily break the encryption (if n isn't prime). There was even a defcon panel (2016 I think) that discussed this very problem and how it is often ignored.

[@Legendarior]

In the previous video regarding this topic, with the color mixing, he mentions that n is a prime number.

[@tissuepaper9962]

I really was hoping he would explain why n has to be prime. I'm thinking the reason is that the search space of [numbers] mod n would be much smaller than n if it weren't a prime number, but that's just my intuition and I'm not sure if I'm right.

[@MarioFanGamer659]

@@tissuepaper9962 The goal is to have the denominator and numerator being coprime i.e. their greatest common divisor is 1 as otherwise, you'd end up getting 0 as the result. The only way to guarantee that is with a prime number which is naturally coprime to any number.

[@natedsamuelson]

Somehow this is the first time I've seen the clock representation of modulo. Really helpful to conceptualize when you're rushing through a problem!

[@grasweg3]

Really? I've never seen it explained without this clock representation.

[@shijovarghese95]

Thank you so much, this really helped me get to grips with SSH!

[@shanedk]

4:05 - To be more accurate, it's the same as long as g, a, and b are all positive. Throw in negative numbers and it doesn't always hold.

[@agrawalyogesh]

Hi Mike, Alice or Bob never shared "g to the power of a or b" but they shared "g to the power of a (b) mod n". But as we continued the example we said they shared the power of a or b. Can you please help explain that?

[@cliftonfestusmalvea9777]

For anyone who got confused with this, we start with the left-hand side of the equation: (g^a mod p)^b mod p = (g^ab mod p) mod p [by the property of modular exponentiation] Now, we move on to the right-hand side of the equation: (g^b mod p)^a mod p = (g^ba mod p) mod p [by the property of modular exponentiation] Since (g^ab mod p) mod p = (g^ba mod p) mod p, we can say that: (g^a mod p)^b mod p = (g^b mod p)^a mod p Hope this helps.

[@lynx-titan]

g must be the generator of cyclic group of n (the set 0..n-1) by repeatedly applying the group operation (exponent, modulo)

[@yah3136]

Wonderful explanation, thank you

[@vibhavsharma9093]

great video, just to clarify modulo math, ((g^a)^b) mod n = ( ( (g^a) mod n )^b )mod n, by using this we can generate same value from both side

[@HarishNarayanan]

This is the most important fact that makes this explanation work.

[@KDOERAK]

Excellent explanation!👍

[@avonstar8893]

Superb explanation!

[@Mark1Mach2]

Great explanation!

[@EquationHub]

Just to caveat, in modulo we deal with numbers from 0 to n-1. We exclude n since the remainder can't be equal n - it must be less than n, otherwise when we're dividing by n and we see that there's a remainder n it means that n could fit one more time in that number leaving us with the remainder 0.

[@jamilxt]

Such an amazing teacher he is! 🤩

[@davidr.flores2043]

Excellent explanation. Thanks a million!!

[@ibrahimgudratli6345]

great explanation!

[@MatthysduToit]

Awesome explanation, thanks!

[@daboyz6106]

Very well explained video.

[@Adam-zb5pr]

thanks for making this so simple to understand!

[@ivanarabome4172]

Great video honestly!!

[@aanesijr]

Is it weird that I found this easier to understand than the one with the colors?

[@kynan7412]

At 1:51 you don't need the n as you have 0. n (mod n) = 0, so the clock would only go from 0, to n-1

[@anonymousvevo8697]

i really love you man, great explanations =)

[@wybird666]

The clock-face analogy is really powerful as it really helps explain why it is not very reversible. "Undoing" g^a%n is effectively going backwards in steps of n and checking to see if g factors into this number an integer number of times. Since a is generally (very) large, we'd have to go backwards an awful lot of steps. There can be more efficient ways of doing it, but conceptually it's the same. Note 2048 bits --> N < 2^2048 ~ 10^616. The world's best supercomputer has a power of ~1exaflop or 10^18 floating point calculations per second. Assuming every attempt could be achieved in 1 operation, that would take 10^598 sec = *10^591 years* I always find it difficult to understand how "difficult" something is when we say p is a really big number, until it is put into a time-to-calculate number.

[@jasonhall947]

Great video!

[@rikwisselink-bijker]

Another thing that I noticed (but doesn't matter), is that actually, Bob can't compute (g^a)^b mod n, because he has to calculate (g^a mod n)^b mod n. The beauty of modulo arithmetic is that the result is the same.

[@jezeremyhubert]

Awesome explanation. Thanks

[@TropicalBrick]

This video is amazing thanks!

[@suparthghimire1644]

So simple yet so beautiful!!

[@kierenyork6791]

I can’t believe people come up with this kind of stuff 😂

[@Snyper20]

Finally a decent video on computerphile... all of them should be AT LEAST this caliber instead of resorting to oversimplified (and hence incorrect) analogies.

[@YuriPetrovich]

Very well explained.

[@benjaminshropshire2900]

The missing part is why (g^a mod n) is fast to compute even though the reverse is not. Tl;dr; g^a can be computed by starting with x_0=1 and and defining x_1=a_0^2 or x_1=x_0^2 * g and then doing the same for x_2 and so on. Making the right choices at each step (which is basically reading out the bits of a) you get g^a in at most log2(a)+1 steps.

[@mohammadamiri8847]

Best explanation ever

[@jonahansen]

Very well done!

[@samgregg7]

I'm pretty sure a and b (the private keys) should be between 2 and n-2 inclusive, as a^1 (mod n) is just the value of a itself (mod n), and a^n-1 (mod n) will be 1 by Fermat's Little Theorem, so this would be easy to spot for an attacker.

[@murtuzaalisurti]

This is amazing!!!

[@ecdhe]

It would be useful to explain the shortcomings of Diffie-Hellman, and why we have switched to Elliptic Curve Diffie Hellman (whose math is more complex)

[@sondoanvan5161]

thanks your video is very helpful, but i have a question let's say in signal or realtime chat webapp WhatsApp using Diffie Hellman, on server side only public key is saved. So I have a question where is the private key stored for each user when they log in so that they can be retrieved and every time you log in on another device, how do you get that user's private key? thanks and hope you can help me answer my question

[@danybeam]

I imagine there are not enoguh cases to make a whole new channel but as a maths fan and a programmer I really did enjoy... I actually I understood it a little better than my cryptography profesor explanation

[@gggfx4144]

Fantastic interesting video, thank you for uploadinf

[@isaiah20171]

N-1. Great video. Thank you!

[@S3b1Videos]

Thank you, this explained the matter (at least to me) a lot better than wikipedia.

[@kamism770]

Does Alice and Bob gonna share the exponent values with the modulo operation or without it at the first exchange ? Cuz he first said said that both of them gonna use the modulo operation but he completed the analogy with only the exponents values (g^a and g^b)

[@LFSPharaoh]

Amazing explanation. I can almost picture the whole thing in my head, albeit still a rough understanding but this video really helped a lot. Every time I revisit the D/H exchange, it makes me want to start obsessing over prime numbers for some reason.

[@Filaxsan]

Impressive is the right word! Outstanding really, thanks!

[@programmercouple]

There is no better explanation of the "Diffie-Hellman key exchange".

[@syrix5914]

This is extremely elegant.

[@polares8187]

please do more mathematical videos like this.

[@jursamaj]

I think this was back in the 128-bit key era, but I recall an article explaining that it *was* practical to break the key, if you were willing and able to spend a few million dollars on custom chips. No doubt that price tag has gone up with larger keys, but it's reasonable to assume state actors are capable.

[@lenoirzamboni9536]

Best explaining ever! Great!

[@zazzy7681]

The Mike Pound Show