Diffie-Hellman Parameter-Public-Value Injection (MITM)

Updated 13 Sep 2026

• •

  What it is

  • •

    If an attacker can actively rewrite messages in transit (not just passively observe), they don't need to solve any discrete logarithm at all to learn the shared secret — they can simply replace one party's public value with a value of their own choosing, for which they already know the corresponding "private" exponent. If Mallory substitutes Bob's real public value $B$ with $B' = g^{b'}$ for a $b'$ she picked herself, Alice computes a shared secret $A^{b'} \bmod p$ using her real private key $a$ — and Mallory, knowing both $A$ (public) and her own $b'$, computes the exact same value directly, without ever needing to know $a$ or the real $b$.

• •

  When to apply

  • •

    You're in an active man-in-the-middle position (not just eavesdropping) on a Diffie-Hellman exchange — the attack works regardless of how strong the group parameters are, since it sidesteps the discrete log problem entirely rather than solving it.

• •

  Math

  • •

    Replace $B$ with $B' = g^{b'}$ for attacker-chosen $b'$; Alice computes $S = (B')^a = g^{ab'} \bmod p$; attacker computes the same $S = A^{b'} = (g^a)^{b'} = g^{ab'} \bmod p$ directly, using the real $A$ they observed and their own chosen $b'$.

• •

  Worked example

  • •

    Substituting a fake public value built from a small chosen exponent ($b'=3$) in place of Bob's real value, both "Alice" and the attacker independently computed the exact same shared secret — Alice using her real private key against the fake value, the attacker using Alice's real public value against their own known small exponent.

• •

  Python

  • •

    b_prime = 3   # any value the attacker chooses, and knows
    B_fake = pow(g, b_prime, p)
    send_to_alice(B_fake)                     # instead of Bob's real B
    shared_secret = pow(A_real, b_prime, p)   # attacker computes it directly
    

• •

  Related

  • •

    Diffie-Hellman (Textbook Construction)

• •

  Cards

  • •

    Why doesn't this attack need to solve any discrete logarithm problem?

    • •

      The attacker substitutes a public value they generated themselves (from a private exponent they already know), so they can recompute the shared secret directly rather than needing to recover anyone else's real private key.

  • •

    What capability does this attack require beyond simple eavesdropping?

    • •

      Active man-in-the-middle control — the ability to intercept AND rewrite messages in transit, not just observe them.

◌ Explore connections in Graph view