Diffie-Hellman Key-Agreement

Assume we have a large prime $p$

• $y=R_p(g^x)$ can be computed efficiently
• however, given $y,g,p$, it is difficult to find $p$

Example

$p$ and $g$ are public parameters (known by everyone) It is difficult to find $k_{AB}$ using $y_A$ and $y_B$