ser B, and user B sends its own public key B to user A: Public key A User A User B Public key B User A User B Downloaded from Digital Engineering Library @ McGraw-Hill (www.digitalengineeringlibrary.com) Copyright © 2004 The McGraw-Hill Companies. All rights reserved. Any use is subject to the Terms of Use as given at the website. SECURITY COPROCESSORS SECURITY COPROCESSORS 381 4. They both then independently modularly exponentiate the public key, which they just received from the other party, by raising it to the power of their own privately generated random number, a and b, respectively. In other words, user A, which has received the public key B, which is equal to gb mod p, now raises it to the secret power a that only user A knows; therefore, user A now pri- vately obtains a new sequence: (17.1) Likewise, user B, which has received the public key A, which is equal to ga mod p, now raises it to the secret power b that only user B knows; therefore, user B now privately obtains a new sequence: (17.2) The right-hand sides of Equations 17.1 and 17.2 are identical. Therefore, the two parties have just independently generated a common bit S sequence that no third party that may have been eavesdrop- ping on their session can guess or calculate. The interesting characteristic of the DH protocol is that although the associated computations are quite straightforward (albeit difficult to conceive on the back of an envelope), the inverse problem that an attacker confronts is extremely difficult to solve. This called the discrete logarithm problem. In this example, it would mean that an attacker who knows g and p (as they are not secret) and who monitored the line and therefore knows A and B, cannot eas- ily guess or calculate the S sequence. This S sequence, or some derivative of it, can be used as the session key. In some systems, the first device can do the following: Generate randomly a symmetric key KS for the underlying content encryption. Encrypt this secret key Ks using the session key S as the encryption key. Send