Diffie–Hellman, step by step — and the man in the middle it cannot stop

Diffie–Hellman is only as strong as the difficulty of one problem: given g, p and y = g^a mod p, find a. Exponentiation mod p is one-way in practice — anyone can compute g^a quickly with square-and-multiply, and nobody knows how to invert it quickly for a well-chosen group. This is the discrete logarithm problem (DLP). Note the asymmetry that makes the exchange possible: the legitimate party knows a, so it can exponentiate; the eavesdropper must invert, the hard direction. The best known algorithm for a prime field is the number field sieve — sub-exponential, but still infeasible at 2048 bits: RFC 7919 rates the ffdhe2048 group at about 103 bits of symmetric-equivalent strength. DH group sizes must therefore be far larger than AES key sizes: the sizes buy equal effort, not equal bit counts.

The protocol answers one question: can two parties who share no secret agree on one, over a channel anybody can listen to? It answers nothing about who is on the other end. There is no identity in the maths — every value Alice receives (p, g, the peer's public value) is a number any party could have produced. That is not an oversight; authentication was a separate problem in 1976 and still is. A key exchange that also proves identity is called an authenticated key exchange, built by bolting DH together with signatures (TLS 1.2's DHE-RSA) or a pre-shared secret (a PAKE such as SPAKE2, a TLS 1.3 PSK mode, or the Noise family). The DH computation is unchanged — it just gains a proof of who it is talking to, which is exactly the thing the MITM panel below shows is missing.

Each run throws its exponents away: a fresh a per session, computed, used, forgotten. That gives forward secrecy (RFC 7919 §8.8). If an attacker records a session today and steals the long-term key next year, the recorded session stays unreadable, because the only thing that could open it — the ephemeral a and b — no longer exists anywhere. The variant where a party reuses a fixed exponent is static DH, and it is exactly the case where small-subgroup attacks matter: a partial recovery of that fixed exponent keeps paying off. Hence the modern insistence on DHE/ECDHE — the E is for ephemeral.

g generates a subgroup ⟨g⟩ of size ord(g), and the shared secret can only ever be one of those ord(g) values. If ord(g) is small, the secret lives in a small set — no cryptanalysis required, an attacker just enumerates it. If ord(g) contains small prime factors, the DLP splits by the Chinese Remainder Theorem into easy small problems (Pohlig–Hellman): a 2048-bit modulus is worthless if p−1 is 2·3·5·7·…, a smooth number. That is why a good group uses p = 2q+1 with q prime and insists that g and every received public value lie in the order-q subgroup. The order is the size of the space an attacker has to search.

A prime p is a safe prime when q = (p−1)/2 is also prime. The group modulo p is then cyclic of order p−1 = 2q, so the only subgroups have size 1, 2, q and 2q — no room for small subgroups beyond the trivial pair {1, p−1}. That is why the FFDHE groups of RFC 7919 are all safe primes: a peer can enforce "stay in the order-q subgroup" with one cheap test instead of factoring p−1 and checking every factor. It also lets the standard's "nothing up my sleeve" derivation (from π in RFC 3526, from e in RFC 7919) be verified by a client in milliseconds.

An attacker who cannot solve the real DLP can bend the group instead. Send a public value Y of small order r (say r = 2, so Y = p−1): the victim computes S = Y^b mod p, which can only be 1 or p−1 — one bit of b, revealed. Repeat with elements of order 3, 5, 7, … and the residues b mod 2, b mod 3, b mod 5 assemble by CRT into b itself. With ephemeral exponents this is a dead end (b is thrown away), which is why RFC 2785 analyses precisely when protection is needed: static keys, and any protocol where the attacker can test whether an attempted key was correct. The defences are cheap: require 1 < Y < p−1 (RFC 7919 §5.1), use a safe-prime group, stay inside the order-q subgroup (cofactor exponentiation), or hash the shared value into the key so a wrong small-subgroup result cannot be observed.

Finite-field DH with the RFC 7919 groups is DHE in TLS 1.2/1.3 and SSH (RFC 4419). Its elliptic-curve cousin, ECDHE, gives the same security with far shorter keys and is now the default in TLS 1.3, WireGuard and the Signal X3DH handshake — the maths differs (points on a curve instead of integers mod p) but the shape of the exchange below is identical. In every case the raw DH output is fed into a KDF and never used directly as a key, and in every case the exchange must be authenticated — by a certificate signature, a pre-shared key, or a pinned public key — or an attacker simply does what the MITM panel lets you do.