Diffie-Hellman Key Exchange Toy mechanism

Model scope

NEEDS_REVIEW because the exact parameter domain is ambiguous: the spec does not say whether “generator” means a primitive root modulo p or a generator of a subgroup, does not specify a subgroup order, and does not state whether zero or negative private exponents are accepted. The algebra and all four test-vector results are correct under the stated unit and integer assumptions.

• The formulas A = g^a mod p, B = g^b mod p, and shared = B^a mod p = A^b mod p are mathematically correct under standard modular-arithmetic assumptions.
• The specification does not state whether g must be a primitive root modulo p or a generator of a specified subgroup; these are different parameter requirements.
• The specification does not constrain private exponents to nonnegative values or define the subgroup/order from which they are selected.

Units and conventions

• p, g, a, and b are dimensionless integers; no physical units apply.
• p is an integer prime greater than 1.
• g is represented by an integer residue with 1 < g < p and is a generator of the intended multiplicative group or subgroup.
• a and b are nonnegative integer exponents; standard DH deployments normally select them from a specified valid exponent range.
• A, B, and the shared secret are integer residues in the range 0 through p - 1.

Inspectable vector

One of 4 source-bound review vectors:

{
  "inputs": {
    "p": 23,
    "g": 5,
    "a": 6,
    "b": 15
  },
  "expected_outputs": {
    "A": 8,
    "B": 19,
    "shared_from_B_to_a": 2,
    "shared_from_A_to_b": 2
  },
  "working": "A = 5^6 mod 23. 5^2 = 25 mod 23 = 2; 5^4 = 2^2 = 4; 5^6 = 5^4 * 5^2 = 4 * 2 = 8 mod 23. B = 5^15 mod 23. 5^8 = 4^2 = 16; 5^15 = 5^8 * 5^4 * 5^2 * 5 = 16 * 4 * 2 * 5 = 640; 640 mod 23 = 19. B^a = 19^6 mod 23. 19^2 = 361 mod 23 = 16; 19^4 = 16^2 = 256 mod 23 = 3; 19^6 = 3 * 16 = 48 mod 23 = 2. A^b = 8^15 mod 23. 8^2 = 64 mod 23 = 18; 8^4 = 18^2 = 324 mod 23 = 2; 8^8 = 2^2 = 4; 8^15 = 8^8 * 8^4 * 8^2 * 8 = 4 * 2 * 18 * 8 = 1152; 1152 mod 23 = 2."
}

Failure boundary

BREAK_CLAIMED · SELF_FLAGGED

The specification does not state validation behavior for p=0, primitive-root versus subgroup-generator semantics, or negative private values. These inputs expose undefined arithmetic and convention-dependent behavior that can cause rejection inconsistencies, degenerate secrets, or incompatible results.

Other records

Sources and evidence

These pointers bind the page to evidence. They do not grant authority or collapse verification into deployment.

• VERIFIED_LEDGER.json
• evidence-tranche4/tranche4-results.json
• BOUNDARY_HAZARD_CATALOG.json