Additive Group Diffie-Hellman Break (Trivial Discrete Log in Additive Groups)

Updated 13 Sep 2026

•
What it is
- •
  Diffie-Hellman's security depends specifically on the multiplicative group of a finite field (or another genuinely hard group, like a well-chosen elliptic curve) — not on "some abelian group with a repeated operation." If the "exponentiation" step is instead implemented as repeated addition (i.e. the public/shared values are computed via plain multiplication mod $p$ rather than modular exponentiation), the entire scheme collapses: the "discrete log" problem in an additive group is just ordinary division, trivially invertible using a modular inverse — no hardness at all.
•
When to apply
- •
  A DH-flavored protocol computes public/shared values via a single modular multiplication ( $A = g \times a \bmod p$ ) rather than modular exponentiation ( $A = g^a \bmod p$ ) — a direct tell that the "group operation" is addition, not multiplication, however the values are labeled.
•
Math
- •
  $A = g\cdot a \bmod p \;\Rightarrow\; a = A \cdot g^{-1} \bmod p$ (an ordinary modular inverse, computable via Fermat/extended Euclid); shared secret $S = g\cdot a\cdot b \bmod p = B\cdot a \bmod p$ once $a$ is recovered.
•
Worked example
- •
  Recovering $a$ from a real 2048-bit-class DH-style exchange that used multiplication instead of exponentiation — computing $a = A\cdot g^{-1}\bmod p$ and then $S=B\cdot a\bmod p$ — reproduced the exact true shared secret both parties would have derived.

Python

g_inv = pow(g, -1, p)
a = (A * g_inv) % p          # trivial "discrete log" -- just division
shared_secret = (B * a) % p