Diffie-Hellman key exchange

Alice publishes $g^a$ and Bob publishes $g^b$ in a public cyclic group; each can then compute the shared secret $g^{ab}$. Its security relies on the difficulty of recovering the exponents or otherwise solving the computational Diffie--Hellman problem.

In a cyclic group with generator $g$, $n$ participants with secret exponents $a_j$ can exchange $n$ tokens around a ring. Token $j$ starts at $g^{a_j}$ and is successively exponentiated by its next $n-2$ recipients before being sent to the final recipient, whose exponent is the only one missing. That recipient completes the exponentiation locally. Each token makes $n-1$ transmissions, and everyone obtains $g^{{\prod }_j{a}_j}$. Thus $n(n-1)$ transmitted group elements suffice. As with two-party Diffie-Hellman key exchange, authentication is needed.