Alice and Bob each pick a secret exponent, exchange $g^a \mod p$ and $g^b \mod p$ publicly, then independently compute the shared secret $K = g^{ab} \mod p$.

* Both sides reach K = g^(ab) mod p; only g^a and g^b ever cross the wire. *

Public parameters: Prime $p$ and generator $g$ of $\mathbb{Z}_p^*$

Protocol:

1. Alice: Chooses secret $a$, computes $A = g^a \mod p$, sends $A$ to Bob
2. Bob: Chooses secret $b$, computes $B = g^b \mod p$, sends $B$ to Alice
3. Alice computes: $K = B^a = (g^b)^a = g^{ba} \mod p$
4. Bob computes: $K = A^b = (g^a)^b = g^{ab} \mod p$

Both arrive at the same key $K = g^{ab} \mod p$ without it ever crossing the channel!

What Eve sees: $p$, $g$, $A = g^a \mod p$, $B = g^b \mod p$. To find $K$, she'd need $a$ or $b$ — which requires solving the discrete logarithm problem (infeasible for large $p$).

Critical limitation: DH is a key exchange protocol only — it cannot encrypt messages or create signatures. Neither Alice nor Bob can choose what the shared key will be; it's determined by both random exponents.

Go deeper:

• Secret Key Exchange (Diffie-Hellman) — Computerphile — the paint-mixing intuition for the whole exchange.
• Diffie-Hellman key exchange — Wikipedia — canonical reference for the protocol and its math.