curious DHE implementation for key exchange I have made some reverse engineering on proprietary software and came up with some DHE algorithm that works like this:

First and foremost, the client and the server shares some public parameters (g, p) where p is a prime number :

# the client generates some random number X
# Then...
A = g^X % p
B = 4^X % p


At this stade, A and B are two numbers computed with some exponentioation modulus p.

The client keeps A for itself and sends B over network to the server.

I can't guess out what's the server doing with B.

What comes up next is that the server sends the client back some buffer which is 20 bytes long. This buffer is xored with the first 20 bytes of the little-endian representation of A. Meaning something like this:

key = buffer ^ A[0...20]


And there you go, key is the shared key between the client and the server.

I am trying to guess out how the server generated that xoring buffer, and what did it compute with 'B'. Any clue?

Edit:

For instance, I have these numbers:

g=4251748925932087506992136911681457196421197968417424634771122535345596546655443876920558972863202693157925206950493858768680434551750613271334944372387511

p=7552255105811443149655814117645061441469802313473420161620729142606560015854445500056007762660457578016660416343667268412286196867181440500178902692672641

X (random number) = 8788592173807205653697600075440308493757969005221433286958441247128089107594429784362875543428031794230308326680487467902465260209524609291268858491985100

How could  the server compute A?
I haven't checked, is $p$ a safe prime and/or is 4 a generator over $p$?

Server has random secret $S$, known $p$ and $g$ a generator.  I'm substituting in $V$ for your $g$, with $g = 4$.

$V = g^S \mod p$

$V$ is a verifier of the server, as in SRP.

$V$ is your $g$, so known by the client.  Anyone knowing $V$ can establish communications with the server.

You calculate for random $X$

$A = V^X \mod p$
$B = g^X \mod p$

So, when you send $B$, server calculates

$A = B^S = g^{XS} = V^X \mod p$

This is one-way authentication, of the server only.  You could do the same thing with the client, and have a mutually authenticated DH key exchange (each client would need a secret as well, and the server would have to know the corresponding verifier).

What's curious is why bother sending back anything, why not just use $A$ directly (or a hash of it, for example)?  If the 20-byte value isn't checked against anything else, it seems sort of useless.  It could be used as a proof, e.g. hash of $A$, but you don't indicate that it's used for anything except to XOR it with $A$.  Since it's being sent in the clear, it doesn't really add anything to the security.