Lion Cipher Lab

Implement Diffie-Hellman key exchange from scratch — then break it three ways: machine-in-the-middle, small-subgroup confinement, and reused ephemerals

• Foundations
• Advanced
• ~75 min
• Free · no account required

Why it matters

Diffie-Hellman is the idea that made the modern internet possible: two people who have never met, shouting across a wire that everyone can hear, end up sharing a secret that the listeners do not have. Every HTTPS connection you make performs a key exchange descended from it. But it is also the single most instructive piece of cryptography to build yourself, because the naive version is correct and completely insecure at the same time. It is secure against someone passively listening, and it is worthless against someone who can modify the traffic — and that gap is not a bug in an…

What you'll learn

• implementing Diffie-Hellman key exchange in pure Python 3 standard library — modular exponentiation, private exponents, public values, shared secret
• reading a real cryptographic parameter set (RFC 3526 MODP Group 14) and verifying it yourself instead of trusting it: safe prime, prime-order subgroup, valid generator
• understanding why the discrete logarithm problem is what makes DH work, and measuring how its difficulty scales by solving one in a tiny group
• knowing that a raw DH shared secret is a group element, not a key — and running it through a KDF before use
• building a working machine-in-the-middle against your own exchange and seeing the two distinct session keys it produces
• demonstrating small-subgroup confinement and recovering bits of a private exponent from a malicious public value
• writing the public-key validation check that stops it (range check plus subgroup check)
• proving the difference between static DH and ephemeral DHE by retroactively decrypting five recorded sessions
• defining forward secrecy concretely and judging when finite-field DH, X25519, or a post-quantum hybrid is the right choice

Steps in this lab

1. The problem Diffie-Hellman solves, and the five words you need
2. Set up, and write the group — a REAL one, from RFC 3526
3. Do not trust the parameters — verify them yourself
4. Why p must be enormous: solve a discrete logarithm yourself
5. Run the exchange: two machines, one secret, no shared history
6. The raw shared secret is NOT a key — always run it through a KDF
7. BREAK 1 — the machine-in-the-middle: DH is unauthenticated by construction
8. What actually fixes Break 1 — and why certificates exist
9. BREAK 2, part one — degenerate public values collapse the whole secret
10. BREAK 2, part two — real small-subgroup confinement, and the validation that stops it
11. BREAK 3 — reused exponents, static DH, and the loss of forward secrecy
12. When you would actually reach for finite-field DH in 2026 — and when you would not
13. The forward pointer: a quantum computer breaks exactly what you just built
14. The judgment: what to actually take away from this

Open the full interactive lab →