Diffie–Hellman Protocol

$F- \text{Finite Field}$

$g\in F^x$

$n=\text{ord}_{F^x}(g)$

$$ \begin{matrix} \text{Alice} & \xrightleftarrows[g^Y]{g^X} & \text{Bob} \\ \\ 1\leq X\leq n-1 && 1\leq Y\leq n-1

\end{matrix} $$

Subgroup Attack

For $a\in \N$

$$ \begin{matrix} \text{Alice} & \xrightleftarrows[(g^Y)^a]{g^X} &\text{Eve} &\xrightleftarrows[g^Y]{(g^X)^a} & \text{Bob} \\ \Downarrow&&&&\Downarrow\\ K=g^{axy}&&&&K=g^{axy} \end{matrix} $$

Take $a\in \N:\ a\mid n,\ \frac{n}a$ is “small”

Now, $K=K=g^{axy}=(g^a)^{xy}$

$\text{ord}{F^x}(g^a)=\frac{\text{ord}{F^x}(g)^n}{\gcd(\text{ord}_{F^x}a)}= \frac{n}{\gcd(n,m)}=\frac{n}{a}$← small number

Therefore, $|\braket{\ g^n\ }|= \frac{n}{a}$ and $K\in \braket{\ g^n\ }$

So, Eve can apply brute force to recover $K$

Solution: Take $g\in F^x\ st.\ \text{ord}(g)=n$ is prime

Examples:

$\Z_{73}=F\implies |F|^x=72,\ F^x\cong \Z_{72},\$ $\ n=72,\ a=36,24,\cdots,\ \frac{n}a = 2,3,\cdots$

$F=\Z_{83}$

$|F^x|=83-1=82= 2\cdot 41$

$g\in F^x$ where the order is $41$

Error-Correcting Codes