Diffie-Hellman Key Exchange Toy

Inspectable records

Ledger state

The current ledger marks this instrument verified clean within the source-bound verification corpus.

Area

Computing & Information

Tranche

tranche-4

Evidence ID

t4-112

Ledger rows

1

No ledger note is attached.

Review findings

NEEDS_REVIEW because the exact parameter domain is ambiguous: the spec does not say whether “generator” means a primitive root modulo p or a generator of a subgroup, does not specify a subgroup order, and does not state whether zero or negative private exponents are accepted. The algebra and all four test-vector results are correct under the stated unit and integer assumptions.

Formula and scope findings

• The formulas A = g^a mod p, B = g^b mod p, and shared = B^a mod p = A^b mod p are mathematically correct under standard modular-arithmetic assumptions.
• The specification does not state whether g must be a primitive root modulo p or a generator of a specified subgroup; these are different parameter requirements.
• The specification does not constrain private exponents to nonnegative values or define the subgroup/order from which they are selected.

Unit assumptions

• p, g, a, and b are dimensionless integers; no physical units apply.
• p is an integer prime greater than 1.
• g is represented by an integer residue with 1 < g < p and is a generator of the intended multiplicative group or subgroup.
• a and b are nonnegative integer exponents; standard DH deployments normally select them from a specified valid exponent range.
• A, B, and the shared secret are integer residues in the range 0 through p - 1.

Boundary hardening

BREAK_CLAIMED · SELF_FLAGGED

The specification does not state validation behavior for p=0, primitive-root versus subgroup-generator semantics, or negative private values. These inputs expose undefined arithmetic and convention-dependent behavior that can cause rejection inconsistencies, degenerate secrets, or incompatible results.

Errata and corrections

No applied erratum is attached to this unique-name record.

Inspectable example

4 review vectors are recorded. One source-bound sample is shown below.

{
  "inputs": {
    "p": 23,
    "g": 5,
    "a": 6,
    "b": 15
  },
  "expected_outputs": {
    "A": 8,
    "B": 19,
    "shared_from_B_to_a": 2,
    "shared_from_A_to_b": 2
  },
  "working": "A = 5^6 mod 23. 5^2 = 25 mod 23 = 2; 5^4 = 2^2 = 4; 5^6 = 5^4 * 5^2 = 4 * 2 = 8 mod 23. B = 5^15 mod 23. 5^8 = 4^2 = 16; 5^15 = 5^8 * 5^4 * 5^2 * 5 = 16 * 4 * 2 * 5 = 640; 640 mod 23 = 19. B^a = 19^6 mod 23. 19^2 = 361 mod 23 = 16; 19^4 = 16^2 = 256 mod 23 = 3; 19^6 = 3 * 16 = 48 mod 23 = 2. A^b = 8^15 mod 23. 8^2 = 64 mod 23 = 18; 8^4 = 18^2 = 324 mod 23 = 2; 8^8 = 2^2 = 4; 8^15 = 8^8 * 8^4 * 8^2 * 8 = 4 * 2 * 18 * 8 = 1152; 1152 mod 23 = 2."
}

Related workflows

Sources and evidence

These pointers bind the page to evidence. They do not grant authority or collapse verification into deployment.

• VERIFIED_LEDGER.json · VERIFIED_CLEAN
• evidence-tranche4/tranche4-results.json
• BOUNDARY_HAZARD_CATALOG.json