Walk through a concrete ECDH key exchange using the curve $y^2 \equiv x^3 + 8x + 5 \mod 11$ with base point $P(0, 4)$.
Alice picks $a=14$, computes $A = 14 \cdot P = (0,7)$. Bob picks $b=13$, computes $B = 13 \cdot P = (1,5)$. Both independently compute the shared secret $K = (1,6)$, using only the x-coordinate as the key.
* Each side multiplies the other's public point by its own secret, so both reach $ab\cdot P = (1,6)$; only its x-coordinate (1) becomes the shared key. *
Public parameters: Curve $y^2 = x^3 + 8x + 5 \mod 11$, base point $P = (0, 4)$
Alice (secret $a = 14$):
- Computes $A = 14 \cdot P = 14 \cdot (0,4) = (0,7)$
- Sends $A = (0,7)$ to Bob
Bob (secret $b = 13$):
- Computes $B = 13 \cdot P = 13 \cdot (0,4) = (1,5)$
- Sends $B = (1,5)$ to Alice
Shared secret computation:
- Alice: $K = a \cdot B = 14 \cdot (1,5) = (1,6)$
- Bob: $K = b \cdot A = 13 \cdot (0,7) = (1,6)$
Verification: $K = 14 \cdot 13 \cdot (0,4) = 182 \cdot (0,4)$. Since $182 \mod 15 = 2$ (group order is 15 here), $K = 2 \cdot (0,4) = (1,6)$ ✓
Important: Only the x-coordinate of $K$ is used as the shared symmetric key! (The y-coordinate is discarded.)
Key difference from classical DH: In EC-DH, groups of prime order can be used directly (unlike $\mathbb{Z}_p^*$ where $|G| = p-1$ is always even). This eliminates the need for subgroup selection in many cases.
Go deeper:
Corbellini — ECC part 3: ECDH and ECDSA — a full ECDH walk-through with runnable Python.- Elliptic-curve Diffie–Hellman — Wikipedia — the protocol and its security assumptions.