THE GARDEN

Static-Key Generator Substitution Attack (Diffie-Hellman)

Updated 13 Sep 2026

• •

  What it is

  • •

    If a party in a Diffie-Hellman exchange reuses the same static private exponent across multiple connections and blindly trusts externally-supplied $(p, g)$ parameters for each one, an attacker can trick them into directly computing (and handing back) a shared secret from an earlier, already-observed exchange. Sending that party the previously-intercepted public value $A$ as the generator $g$ makes their response $B' = A^b \bmod p$ — which, since $b$ is their unchanged static private key, is exactly the shared secret $A^b$ that the real exchange with Alice would have produced.

• •

  When to apply

  • •

    You've passively observed one full Diffie-Hellman exchange (capturing $p$, $g$, $A$), and you have the opportunity to initiate a new connection to the party whose private key is static (unchanging across sessions) and who accepts caller-supplied group parameters.

• •

  Math

  • •

    Real shared secret $S = A^b \bmod p$; sending $g' = A$ makes Bob compute $B' = (g')^b = A^b \bmod p = S$ directly — Bob unwittingly computes and reveals the shared secret from the other conversation.

• •

  Worked example

  • •

    Substituting a real, previously-observed public value $A$ in place of the generator when initiating a fresh connection to a static-key party produced a response mathematically identical to $A^b \bmod p$ — exactly the shared secret from the original, unrelated exchange.

• •

  Python

  • •

    send_to_bob({"p": p, "g": A_intercepted, "A": "0x01"})   # A here plays the role of the generator
    shared_secret = int(bob_response["B"], 16)   # this literally IS A_intercepted ** b mod p
    

• •

  Related

  • •

    Diffie-Hellman (Textbook Construction)

  • •

    Diffie-Hellman Parameter-Public-Value Injection (MITM)

• •

  Cards

  • •

    Why does sending a previously-observed public value as the "generator" reveal the shared secret?

    • •

      Because the responder's static private exponent b doesn't change between sessions, so computing (that value)^b is mathematically identical to the real A^b shared secret from the original exchange.

  • •

    What two conditions does this attack require of the target?

    • •

      A static (reused) private exponent across sessions, and blind trust in caller-supplied group parameters for each new session.

◌ Explore connections in Graph view