Arithmetic on
a clock
A clock counts to twelve and starts over. Modular arithmetic does the same with any modulus. Powers modulo a prime reveal cyclic groups and subgroups; deployed key exchanges often use a large prime-order subgroup rather than every nonzero residue.
Powers that walk the clock
Fix a prime p and a base g. Compute g¹, g², g³, … mod p and mark each result on the ring below. If g is a primitive root, the marks visit all p−1 positions before returning home — a single unbroken orbit. If not, the orbit closes early, missing most of the clock.
The one-way staircase
Computing gˣ mod p is efficient. Recovering an exponent from the result is the discrete logarithm problem. This tiny group is easy to search; suitable large groups make known attacks expensive. The result constrains the exponent modulo the order of g.
The original public-key setting
In finite-field Diffie–Hellman, Alice sends gᵃ and Bob sends gᵇ; each computes gᵃᵇ. Computing that value as an eavesdropper is the computational Diffie–Hellman problem. Solving a discrete logarithm would suffice, but discrete-log hardness alone is not a proof of CDH hardness.
Many deployed finite-field DH groups use a safe prime and a large prime-order subgroup. This avoids treating small-order elements as acceptable public keys, provided implementations also apply the protocol's public-key validation rules. Choosing a generator alone does not prevent an active attacker from sending an invalid or small-order value.
See also: Group Theory for the general structure, and Finite Fields for the elliptic-curve version.
Sources and scope: RFC 7919 (2016), standardized finite-field DH groups and validation; Boneh and Shoup, §10.4.2, CDH and discrete logarithms.