Arithmetic on
a clock
A clock counts to twelve and starts over. Modular arithmetic does the same with any number — and inside that wrap-around lives the cyclic structure that key exchange is built on. Some starting points visit every hour on the clock; those are the ones cryptography wants.
Powers that walk the clock
Fix a prime p and a base g. Compute g¹, g², g³, … mod p and mark each result on the ring below. If g is a primitive root, the marks visit all p−1 positions before returning home — a single unbroken orbit. If not, the orbit closes early, missing most of the clock.
The one-way staircase
Going up — from an exponent to gˣ mod p — is a quick climb. Coming back down — from gˣ to x — is the discrete logarithm problem, the same wall we met with elliptic curves, in its original multiplicative form. The orbit above looks orderly, but knowing a landing spot tells you nothing about how many steps it took to get there.
The original public-key setting
Textbook Diffie–Hellman happens in exactly this group: a prime with a primitive root, thousands of bits wide. Alice sends gᵃ, Bob sends gᵇ, and both compute gᵃᵇ — while an eavesdropper, stuck with the discrete log, cannot. Elliptic curves later swapped this multiplicative clock for a point group, but the shape of the idea was born here.
Deployed Diffie–Hellman adds one refinement worth knowing. A primitive root generates everything mod p, including the small cycles hiding inside the group, and an attacker who can push a key exchange into one of those learns far more than they should. So the standard groups use a safe prime and a generator chosen to walk a single large prime-order subgroup instead — often g = 2, which is not a primitive root at all. No small cycles to be trapped in. The clock is the right picture; real implementations just fence off part of the dial.
See also: Group Theory for the general structure, and Finite Fields for the elliptic-curve version.