Diffie-Hellman when $p$ and $g$ are pre-agreed and hidden from Eve During a regular Diffie–Hellman public key exchange, Alice and Bob agree to use a prime number $p$ and a base $g$… which are both made public and are therefore also assumed to be known by Eve. Alice chooses a secret integer $a$ and sends $(A = g^a \mod p)$ to Bob, Bob chooses a secret integer $b$ and sends $(B = g^b \mod p)$ to Alice, etc.

One of the main pitfalls with a Diffie–Hellman public key exchange is, that Eve could try to use $p$ and $g$ for cryptanalysis, potentially learning the DH secret. Eve would have to solve the Diffie–Hellman problem to obtain $g^{ab}$. This makes things hard for Eve, but given enough computing power, it is not impossible.

Now, if Alice and Bob would agree upon $p$ and $g$ in advance (for example, during a face-to-face meeting in a SCIF), they would not have to agree upon $p$ and $g$ in public. As a result, Eve would have no option to learn the values of $p$ or $g$. 

Under this condition:


Would it still be possible for Eve to work out the shared secret key that Alice and Bob calculate? After all, Eve would only be able to intercept Alice’s $A$ and Bob’s $B$. Would it be feasible for Eve to learn anything (useful) at all, or would the missing $p$ and $g$ make it impossible for Eve to calculate the secret (even when assuming she had solved the DH problem)?
What would be the impact on security, if Alice and Bob would “reuse” those $p$ and $g$ values for more than a single public key exchange? Would that give Eve any advantage in this scenario?
For the moment assume $g$ is a secret (uniformly random) generator, but that $p$ may be known to the adversary. Then given only $g^a, g^b$, the Diffie-Hellman key $g^{ab}$ is information-theoretically uniform (up to small statistical error), i.e., it cannot even be found by brute force because the adversary does not have enough information to determine it. This is because every generator $h=g^c$ for all $c$ (coprime to the group order) is equally likely to be the "real" one, so the "real" key is equally likely to be $g^{ab/c^2}$. Such values essentially cover all group elements (up to rare degeneracies). So essentially, Alice and Bob have a true one-time pad value.

However, this is not really interesting, because Alice and Bob were able to set up a secret generator $g$ in the first place, which is just as good as (or better than) a one-time pad value.

If Alice and Bob use the same $g$ for two or more runs of the protocol, then there is only one "degree of freedom" in the derived keys. That is, knowing one key (and the public messages) information-theoretically determines all the others. So any hope that the keys would look uniform and independent would have to depend on a computational assumption.

This all assumed that $p$ was known. It's much harder to analyze what happens when $p$ is unknown, because revealing group elements reveals some information about $p$, but it's hard to say what.