1

2

3

4

5

Ba = (gb)a = gab = (ga)b = Ab (mod p).

6

7

  1. Diffie, W., Hellman, M. E. (1976). New directions in cryptography. IEEE Transactions on Information Theory 22(6), 644–654. doi:10.1109/TIT.1976.1055638, PDF.
  2. Harkins, D., Carrel, D. (1998). The Internet Key Exchange (IKE). RFC 2409, IETF. Oakley groups 1 and 2 (§6.1, §6.2). rfc-editor.org/rfc/rfc2409.
  3. Kivinen, T., Kojo, M. (2003). More Modular Exponential (MODP) Diffie-Hellman groups for Internet Key Exchange (IKE). RFC 3526, IETF. Group 14 (§3). rfc-editor.org/rfc/rfc3526.
  4. Pohlig, S. C., Hellman, M. E. (1978). An improved algorithm for computing logarithms over GF(p) and its cryptographic significance. IEEE Transactions on Information Theory 24(1), 106–110. doi:10.1109/TIT.1978.1055817, PDF.
  5. Pollard, J. M. (1978). Monte Carlo methods for index computation (mod p). Mathematics of Computation 32(143), 918–924. doi:10.1090/S0025-5718-1978-0491431-9.
  6. Adrian, D., Bhargavan, K., Durumeric, Z., Gaudry, P., Green, M., Halderman, J. A., Heninger, N., Springall, D., Thomé, E., Valenta, L., VanderSloot, B., Wustrow, E., Zanella-Béguelin, S., Zimmermann, P. (2015). Imperfect forward secrecy: How Diffie-Hellman fails in practice. Proc. ACM CCS 2015, 5–17. doi:10.1145/2810103.2813707, PDF.
  7. Boudot, F., Gaudry, P., Guillevic, A., Heninger, N., Thomé, E., Zimmermann, P. (2020). Comparing the difficulty of factorization and discrete logarithm: a 240-digit experiment. CRYPTO 2020, LNCS, 62–91. doi:10.1007/978-3-030-56880-1_3, ePrint 2020/697.
  8. Barker, E. (2020). Recommendation for Key Management: Part 1 – General. NIST SP 800-57 Part 1 Rev. 5. doi:10.6028/NIST.SP.800-57pt1r5.