Diffie-Hellman Key Exchange: Square-and-Multiply Ladder (2D)

Public Parameters

Prime modulus p 337

Generator g 3

Private Keys

● Alice's secret a 0

● Bob's secret b 0

Live Results

Alice public A = g^a mod p

—

Bob public B = g^b mod p

—

Shared secret K — not computed yet

Ladder rungs (bits climbed)

0 / 0

Squarings · Multiplies

0 · 0

How it works (2D model)

The 3D companion walks Alice's and Bob's exponents one multiplication at a time — g, g², g³, … — which takes a steps for exponent a. Real cryptographic libraries never do that; they use square-and-multiply (binary exponentiation), which needs only about log₂(a) steps by reusing each squared value:

result = 1
for each bit of the exponent, most-significant first:
    result = result² mod p          (always: one "rung" of the ladder)
    if bit == 1: result = result·g mod p   (extra "kick" on a 1-bit)

This 2D view plots exactly that recurrence. The top ladder draws one rung per exponent bit — height advances with each step, horizontal jitter shows the normalized residue value result/p at that rung; a filled diamond marks a 1-bit (square and multiply), a plain dot marks a 0-bit (square only). The bottom strip maps every residue 0..p−1 onto a single horizontal line and drops a marker at Alice's and Bob's current running value each rung — the same "nearby exponents land far apart" chaos the 3D ring shows, but read off a line instead of a spiral.

p, g sliders — public modulus and generator; both ladders restart.
a, b sliders — private exponents, used only locally to build each ladder.
Run Key Exchange — climbs both ladders bit by bit, then computes K = B^a mod p and K = A^b mod p independently (each itself via square-and-multiply) and confirms they match.

Both algorithms compute the identical g^a mod p — this view only changes how many steps it takes (≈log₂(a) here vs. a on the 3D page) and what a "step" looks like, which is precisely why real TLS implementations use binary exponentiation: the discrete-log hardness is unchanged, but forward computation stays fast even for exponents hundreds of digits long, where a linear walk would never finish.

Alice's ladder (g^a mod p) Bob's ladder (g^b mod p) Shared secret K