New Directions in Cryptography · 1976
Alice and Bob have never met. Everything they send each other crosses a wire that Eve copies in full. Yet in five moves they arrive at the same colour — and Eve, holding every message, cannot mix it. This is the trick that retired the key courier: mixing paint is easy, unmixing is not.
WebGL is unavailable here — this is a still of the exchange. The arithmetic below runs regardless.
Each stirs their private colour into the other's mixture.
Eve copies everything below the wire
Alice's pot
#——
sampled from framebuffer
Eve's attempt
#——
both mixtures, stirred together
Bob's pot
#——
sampled from framebuffer
alice vs bob · converging…eve · watching the wire
The same trick, in numbers
Mixing colours is easy and unmixing is hard — that asymmetry is the whole invention. In the protocol proper the "paint" is arithmetic: raising g to a power, modulo a prime, is quick in one direction and a wall in the other. The numbers below are deliberately toy-sized so you can watch every move; each value is computed live on this page.
private a = ·never leaves the bench
sends A = ga mod p = ·
receives B = ·
secret s = Ba mod p = ·
prime p = ·
generator g = ·
Alice sent A = ·
Bob sent B = ·
four numbers, zero secrets — s never crosses
private b = ·never leaves the bench
sends B = gb mod p = ·
receives A = ·
secret s = Ab mod p = ·
The honest failure
Eve holds p, g, A and B — everything that crossed the wire. To recover Alice's secret she must find the exponent: which power of g equals A? That is the discrete logarithm, and at toy scale she can simply walk the door frame: g¹, g², g³, … Here the door is at most 2,026 exponents wide. Watch her open it.
exponents tried
0
current test
gx mod p = ·
She hasn't started. The counter is honest — it really computes gx step by step until one matches A.
At this demo scale, seconds. Now scale the door: a real exchange uses a prime of 2,048 bits and secret exponents drawn from a space of 2256. The same counter, ticking a billion times a second, needs on the order of 1060 years — roughly 1050 times the age of the universe. Cleverer attacks than counting exist (index calculus, the number field sieve), and against a well-chosen 2,048-bit group they too remain hopelessly out of reach. Alice's move cost her · modular multiplications. That gap — dozens of multiplications one way, geological time the other — is the entire security of the scheme.
1976
Whitfield Diffie and Martin Hellman published New Directions in Cryptography in November 1976, crediting Ralph Merkle's puzzle scheme as a seed of the idea. Years earlier, by most accounts, GCHQ's James Ellis, Clifford Cocks and Malcolm Williamson had reached similar mathematics in secret — classified until 1997. Either way: for the first time, two strangers could agree on a key without ever meeting, and without trusting the channel between them.
What's real here
The paint is a real simulation. Three pigment concentrations are advected through a GLSL fluid and combined by Beer–Lambert subtractive mixing — the hue of every pot is an outcome, not a token. The hex values under the pots are sampled from the rendered framebuffer as the paint converges; the pour quantities are measured mid-sim to hold the recipe honest; and Eve's counter genuinely computes every power of g. Nothing is scripted to match.