Interactive Educational Project

Elliptic Curve Cryptography Lab

Watch Alice and Bob agree on a secret over a public channel using ECDH (P-256), derive an AES key with HKDF-SHA-256, and exchange messages encrypted with AES-GCM. Everything runs locally in your browser with the Web Crypto API. Nothing is sent to a server.

Open the lab

Simulation

Ready. Press “Start Simulation” to begin.

AAliceIdle
Alice’s public key →
Public channel
← Bob’s public key
BBobIdle
  1. Generate Alice’s and Bob’s ECDH P-256 key pairs
  2. Exchange public keys over the open channel
  3. Each side computes the ECDH shared secret
  4. Each side derives an AES-256 key with HKDF-SHA-256
  5. Compare derived keys
  6. Encrypt with AES-GCM and decrypt on the other side

Alice

Public key (raw, uncompressed, hex)

Not generated yet

Shared secret fingerprint

—

Derived AES key fingerprint

—

Bob

Public key (raw, uncompressed, hex)

Not generated yet

Shared secret fingerprint

—

Derived AES key fingerprint

—

Key verification

Waiting for simulation

Fingerprints are SHA-256 hashes (first 16 bytes). Showing them is safe here because this is a demo. Real applications never display secrets.

Encrypt and decrypt a message

Nonce / IV (12 bytes, hex)

—

Ciphertext + authentication tag (hex)

—

Ciphertext + tag (Base64)

—

Decrypted plaintext (recipient’s view)

—

How it works

ECDH

Elliptic Curve Diffie-Hellman lets two parties each hold a private scalar and publish a matching curve point. Combining your private key with the other side’s public key gives both parties the same shared secret, while an eavesdropper who sees only the public keys cannot compute it. This lab uses the NIST P-256 curve.

HKDF

The raw ECDH output is not a ready-to-use key. HKDF (HMAC-based Key Derivation Function) with SHA-256 extracts its entropy and expands it into a uniform key. A salt and a context string (“info”) bind the key to this specific use.

AES-GCM

AES-GCM is authenticated encryption. It hides the message and attaches a tag that detects any modification. Every message needs a unique random nonce; reusing a nonce with the same key breaks its security. Here nonces come from crypto.getRandomValues.

Security notice

ECDH alone does not authenticate the participants. If an attacker sits between Alice and Bob, they can replace both public keys with their own and establish one secret with each side. They can then read and modify every message (a man-in-the-middle attack). Real protocols prevent this with digital signatures, certificates, or out-of-band verification of key fingerprints, as in TLS or Signal. This lab is a teaching tool, not a production security system.