Diffie-Hellman key exchange method

🔐 What is AES and How It's Used

AES (Advanced Encryption Standard) is a symmetric key encryption algorithm widely adopted across the internet for secure communication. In symmetric encryption, the same key is used for both encryption and decryption.

🧠 Key Concepts

• Block cipher operating on 128-bit blocks of data
• Supports 128, 192, and 256-bit keys — AES-256 is the strongest
• Used in messaging apps, VPNs, HTTPS, and secure storage
• Relies on fast, deterministic transformations based on the key

🔁 Why It's Called Symmetric

In symmetric encryption like AES, both the sender and receiver use the exact same secret key to encrypt and decrypt messages. This makes it very fast and efficient, but it requires a secure method to share the key — which is where algorithms like Diffie-Hellman or RSA help.

💡 How It Works in This Demo

1. Diffie-Hellman is used to generate a shared secret number.
2. SHA-256 hashes the shared number into a 256-bit AES key.
3. This AES key encrypts the message using CryptoJS.AES.encrypt.
4. The same key decrypts the ciphertext using CryptoJS.AES.decrypt.

const derivedKey = CryptoJS.SHA256(sharedSecret.toString()).toString();
const encrypted = CryptoJS.AES.encrypt(message, derivedKey).toString();
const decrypted = CryptoJS.AES.decrypt(encrypted, derivedKey).toString(CryptoJS.enc.Utf8);

📦 Real-World Applications of AES

• Web Security (HTTPS): Browsers use AES after exchanging keys via RSA or DH.
• Messaging Apps: Signal and WhatsApp encrypt messages using AES-256.
• Disk Encryption: Full-disk tools like BitLocker and FileVault use AES.
• VPN Tunnels: Encrypted traffic using AES in CBC or GCM modes.

Symmetric vs Asymmetric Encryption – What’s the Difference?

Modern cryptography uses two broad types of encryption: symmetric (same key for encryption/decryption) and asymmetric (different keys for encryption and decryption). Both have different roles in secure communications.

Why Multiplication of Two Primes Matters

The number 1767051 is the product of two primes (1291 and 1369). In cryptography, such composite numbers are used in schemes like RSA, where factoring the product is hard. For Diffie-Hellman, we use a large prime modulus to create a finite cyclic group that allows secure key exchange. Here, we use one prime (1291) to demonstrate Diffie-Hellman key exchange.

Step-by-Step AES Encryption via Diffie-Hellman Shared Key

1. Choose a large public prime (p): 1291
   Used as the modulus for modular arithmetic in the Diffie-Hellman group.
2. Select a primitive root modulo p (generator g): 2
   This number generates all elements of the group, ensuring full keyspace.
3. Alice selects a private key (a): 911 (kept secret)
4. Bob selects a private key (b): 621 (kept secret)
5. Alice computes her public key: A = g^a mod p = 1015
   This is sent to Bob over an insecure channel.
6. Bob computes his public key: B = g^b mod p = 810
   This is sent to Alice over an insecure channel.
7. Alice computes the shared secret: B^a mod p = 631
8. Bob computes the shared secret: A^b mod p = 631 (same as Alice's)
9. Derive the AES-256 key: SHA-256 hash of the shared secret, producing a secure 256-bit key.
   (Key starts with: 7b81eb727ed48055fa55c5e03aaa43f2...)
10. Encrypt a message using AES-256: Hello Bob, this is Alice.
    Encrypted ciphertext (Base64): U2FsdGVkX19TmBh2bMYhVc5BYCv3hTRGnGg/V28MhDUc5hw+C37H7ys7mITSyzPB
11. Decrypt the ciphertext using the same AES-256 key: Hello Bob, this is Alice.
12. Verification: The decrypted message matches the original, confirming secure communication.

How AES-256 Encryption Works with Diffie-Hellman Shared Secret

Step 1: Deriving the AES-256 Key from the Shared Secret

After the Diffie-Hellman key exchange, both parties have the same shared secret (a number, e.g., 631). AES-256 requires a fixed-length 256-bit key (32 bytes). A cryptographic hash function (SHA-256) converts this secret into a fixed-length, secure key.

const sharedSecret = 631; // from Diffie-Hellman
const aesKey = CryptoJS.SHA256(sharedSecret.toString()).toString();

This guarantees both parties derive the exact same AES key.

Step 2: Encrypting a Message Using AES-256

AES-256 encrypts data in 128-bit blocks using the 256-bit key. Encryption modes (e.g., CBC, GCM) use Initialization Vectors (IVs) for randomness, so the same plaintext encrypts differently each time.

const message = "Hello Bob, this is Alice.";
const encrypted = CryptoJS.AES.encrypt(message, aesKey).toString();

The encrypted string includes both ciphertext and IV information.

Step 3: Decrypting the Message

Decryption uses the same AES key and IV embedded in the ciphertext to recover the original message.

const decrypted = CryptoJS.AES.decrypt(encrypted, aesKey).toString(CryptoJS.enc.Utf8);

Incorrect keys or IVs cause decryption failure or gibberish output.

Summary

1. Diffie-Hellman key exchange generates a shared secret number.
2. SHA-256 hashes the shared secret into a 256-bit AES key.
3. AES-256 encrypts messages with this key and a random IV.
4. The receiver uses the same key and IV to decrypt and recover the message.