What is the Diffie-Hellman key exchange?

Diffie-Hellman is a key-exchange protocol that lets two parties establish a shared secret over an insecure channel without ever transmitting the secret itself. Each side combines its own private value with the other's public value to compute the same shared key, which is then used for symmetric encryption.

How does Diffie-Hellman work?

Both parties agree on public parameters, then each picks a private random number and sends the other a public value derived from it. Using the received public value and their own private number, both independently compute an identical shared secret, while an eavesdropper cannot, because reversing the operation is a hard discrete logarithm problem.

Is Diffie-Hellman secure against man-in-the-middle attacks?

Plain Diffie-Hellman is vulnerable to man-in-the-middle attacks because it does not authenticate the participants, letting an attacker relay and substitute keys. In practice it is combined with authentication such as digital signatures or certificates, as in TLS, to verify each party's identity.

What is the difference between Diffie-Hellman and RSA?

Diffie-Hellman is specifically a key-agreement protocol where both parties jointly derive a shared secret, while RSA is a cryptosystem that can encrypt data or create signatures. Diffie-Hellman is often preferred for establishing session keys because it can provide forward secrecy, which RSA key transport does not.

What is forward secrecy in Diffie-Hellman?

Forward secrecy means that compromising a server's long-term private key does not expose past session keys. Ephemeral Diffie-Hellman, known as DHE or ECDHE, achieves this by generating fresh, temporary key pairs for each session and discarding them afterward, so recorded traffic cannot be decrypted later.

ECDH is the elliptic-curve version of Diffie-Hellman that performs the same key agreement using elliptic curve mathematics instead of modular exponentiation. It offers equivalent security with much smaller keys and better performance, and its ephemeral form ECDHE is the standard key-exchange method in modern TLS.

⚿ Cryptography

Diffie-Hellman Key Exchange Explained

Diffie-Hellman key exchange solves a deceptively hard problem: how can two parties who have never met agree on a shared secret key while an eavesdropper watches every message they send? Published by Whitfield Diffie and Martin Hellman, it was the first practical public-key technique and remains fundamental to protocols like TLS, SSH, and IPsec. Understanding Diffie-Hellman key exchange is essential for grasping how secure channels are bootstrapped over untrusted networks.

The Problem It Solves

Symmetric encryption like AES requires both parties to share the same secret key. But distributing that key over an insecure channel seems circular: anyone listening could simply copy it. Diffie-Hellman breaks this deadlock. It is a key-agreement protocol, meaning neither party sends the final key across the wire. Instead, both parties independently compute the same shared secret from public values they exchange plus private values they keep hidden.

Importantly, Diffie-Hellman by itself provides no encryption and no authentication. It establishes a shared secret, which is then fed into a key-derivation function to produce keys for symmetric ciphers and message authentication codes.

How the Math Works

Classic (finite-field) Diffie-Hellman is built on modular exponentiation and the difficulty of the discrete logarithm problem. The protocol uses public parameters agreed in advance:

A large prime modulus p (commonly 2048 bits or larger)
A generator g, a base value whose powers generate a large subgroup modulo p

The exchange proceeds as follows:

Alice picks a secret random integer a and computes A = g^a mod p, sending A to Bob.
Bob picks a secret random integer b and computes B = g^b mod p, sending B to Alice.
Alice computes s = B^a mod p. Bob computes s = A^b mod p.
Both arrive at the same value because (g^b)^a = (g^a)^b = g^(ab) mod p.

The shared secret is g^(ab) mod p. An eavesdropper sees p, g, A, and B, but recovering the secret requires computing a discrete logarithm to find a or b, which is infeasible for large, well-chosen parameters.

# Conceptual Diffie-Hellman (small numbers for illustration only)
p, g = 23, 5
a, b = 6, 15                 # private secrets
A = pow(g, a, p)            # Alice -> Bob
B = pow(g, b, p)            # Bob -> Alice
s_alice = pow(B, a, p)     # shared secret
s_bob   = pow(A, b, p)     # identical value

The Man-in-the-Middle Weakness

Plain Diffie-Hellman is vulnerable to a man-in-the-middle (MITM) attack. Because the exchanged values carry no proof of identity, an attacker positioned between the two parties can run two separate exchanges, one with each side, and transparently relay and decrypt traffic. Each party believes they share a secret with the other, but both actually share secrets with the attacker.

The fix is authentication. Diffie-Hellman must be combined with a mechanism that proves identity, such as:

Digital signatures on the exchanged values, as in TLS where the server signs its ephemeral parameters with a key backed by an X.509 certificate.
A pre-shared password or key, as in some authenticated key-exchange protocols.

Diffie-Hellman guarantees secrecy of the derived key against passive eavesdroppers, but authentication is what stops active attackers.

Ephemeral Diffie-Hellman and Forward Secrecy

A major reason Diffie-Hellman remains central to secure protocols is forward secrecy (also called perfect forward secrecy). When each session uses fresh, random, single-use key pairs, the arrangement is called ephemeral Diffie-Hellman (DHE) or, on elliptic curves, ECDHE.

The security benefit is significant: because the private exponents are discarded after each session, compromising a server's long-term private key later does not let an attacker decrypt previously recorded traffic. Each session's secret is independent. This is why modern TLS strongly favors ephemeral (EC)DHE key exchange over older schemes where the session key was encrypted to a static RSA key.

Elliptic-Curve Diffie-Hellman (ECDH)

The same idea works over elliptic curves, where it is called ECDH. Instead of modular exponentiation, ECDH uses scalar multiplication of points on an elliptic curve. The hard problem becomes the elliptic curve discrete logarithm problem, which allows much smaller keys for equivalent security.

ECDH, and specifically its ephemeral form ECDHE using curves such as Curve25519 (the X25519 function), is the dominant key-exchange method in modern TLS. It offers strong security, small message sizes, and fast computation.

Choosing Safe Parameters

The security of finite-field Diffie-Hellman depends on well-chosen parameters:

Use a sufficiently large prime, typically 2048 bits or more, and prefer standardized groups.
Prefer safe primes or standardized groups to avoid small-subgroup attacks, and validate received public values.
Avoid weak or unknown-provenance parameters; downgrade attacks against small or shared 512-bit groups have historically weakened poorly configured deployments.
Always pair the exchange with authentication and a proper key-derivation function.

Key Takeaways

Diffie-Hellman key exchange lets two parties derive a shared secret over an insecure channel without ever transmitting the secret itself.
Its classic form relies on modular exponentiation and the discrete logarithm problem; both parties compute g^(ab) mod p independently.
Unauthenticated Diffie-Hellman is vulnerable to man-in-the-middle attacks, so it must be combined with signatures or another identity proof.
Ephemeral Diffie-Hellman (DHE/ECDHE) provides forward secrecy, protecting past sessions even if long-term keys are later compromised.
ECDH brings the same guarantees with smaller keys and is the preferred key-exchange method in modern secure protocols.

diffie-hellmankey-exchangekey-agreementcryptographyforward-secrecy