Asymmetric · 04

Diffie-Hellman Key Exchange

Two strangers, an attacker on the wire, no prior contact. They publish a few numbers in plain view and somehow walk away with a shared secret that the attacker cannot derive. Diffie and Hellman published this trick in 1976 and it still anchors the start of almost every modern secure session.

01

The Problem DH Solves

Diffie-Hellman is not for encrypting messages. It is for establishing a shared secret. Two parties run the protocol over a public channel, and at the end of it they both possess the same number, while anyone watching the wire does not.

This is the missing piece that the Key Distribution page set up. Once Alice and Bob share a secret, they can use it as an AES key and switch to symmetric encryption for the rest of the conversation. DH is the doorway. Symmetric crypto is the room.

02

The Color-Mixing Analogy

Before the math, the intuition. Imagine paint that is trivially easy to mix but practically impossible to un-mix.

  1. Alice and Bob publicly agree on a starting color, say yellow. Eve is listening; she sees the yellow.
  2. Alice privately picks a secret color (red) and mixes it with yellow. She gets orange. She mails the orange paint to Bob. Eve sees the orange too.
  3. Bob privately picks his own secret color (blue) and mixes it with yellow. He gets green. He mails the green to Alice. Eve sees the green.
  4. Alice receives Bob's green and mixes her secret red into it. She gets a brown that contains yellow + blue + red.
  5. Bob receives Alice's orange and mixes his secret blue into it. He gets the same brown: yellow + red + blue.

Alice and Bob now share an identical brown. Eve saw yellow, orange, and green go over the wire, but the only way for her to compute the brown would be to un-mix orange or green to extract Alice's or Bob's secret color. Paint does not un-mix. Discrete logarithms do not un-mix either.

Figure 4.1: The color-mixing analogy A diagram showing Alice and Bob each starting with a public yellow paint, mixing in their private colors (red for Alice, blue for Bob), exchanging the resulting mixtures, then mixing in their private color a second time to arrive at the same final brown. Eve sees only the intermediate mixtures on the wire. ALICE WIRE (Eve watches) BOB Step 1: agree on public color yellow yellow Step 2: each mixes in their secret color, sends result + = yellow + RED = orange orange on wire + = yellow + BLUE = green green on wire Step 3: receive partner's color, mix in own secret again, identical result + = SHARED BROWN + = SHARED BROWN Eve has yellow, orange, green — cannot un-mix
Fig 4.1 · Mixing is easy, un-mixing is hard
03

The Math Version

Replace paint mixing with modular exponentiation. The math has the same one-way property.

  1. Alice and Bob publicly agree on a large prime p and a generator g (a small number whose powers cycle through many values mod p).
  2. Alice picks a private random integer a, computes A = ga mod p, and sends A to Bob.
  3. Bob picks a private random integer b, computes B = gb mod p, and sends B to Alice.
  4. Alice computes s = Ba mod p. Bob computes s = Ab mod p. Both arrive at the same value: s = gab mod p.

The shared secret s is then run through a key derivation function to produce the actual AES key. Eve, watching the wire, has p, g, A, and B. To compute s she would need to recover a from A, or b from B. That is the discrete logarithm problem.

04

Step Through The Exchange

The interactive below runs the math version with small numbers. Click Next step to advance through the protocol one beat at a time.

Interactive · DH Step-Through

Watch the shared secret materialize

Adjust the parameters or use the defaults, then click Next step to advance. The three columns show what Alice knows, what Eve sees on the wire, and what Bob knows. Notice how Eve sees the public values but never the private exponents or the final secret.

Alice
private side
Eve
eavesdropper, sees the wire
Bob
private side
Click "Next step" to begin. Step 1: Alice and Bob agree on public parameters p and g.
05

The Discrete Logarithm Problem

Given g, p, and ga mod p, find a. That is the discrete logarithm problem (DLP). For small numbers it is easy: just try every exponent from 1 up. For numbers used in real DH (primes 2048 to 4096 bits long), the search space is so vast that no efficient algorithm is known.

The best general-purpose algorithm for DLP is the General Number Field Sieve, the same family of method used for RSA factoring. Its difficulty grows sub-exponentially. This is why DH and RSA tend to use similar key sizes for comparable security levels.

DH group sizeStatus
768-bit (e.g. RFC 2409 Group 1)Broken in 2016. Used in many old IPSec and TLS deployments. Logjam attack.
1024-bit (RFC 3526 Group 2)Within reach of well-resourced attackers. Deprecated.
2048-bit and 3072-bitCurrent standards. NIST SP 800-57 minimums.
Elliptic-curve DH (Curve25519, P-256)256-bit ECDH provides roughly 128-bit security. Fast and small. The modern default.
06

Ephemeral DH and Forward Secrecy

One of the most consequential design choices in modern protocols is to use a fresh DH key pair for every session. The variant is called ephemeral DH (DHE or, on elliptic curves, ECDHE). Alice and Bob each pick brand-new secret exponents at the start of every connection and throw them away when the connection closes.

The payoff is enormous and is called forward secrecy: if an attacker later compromises Alice's or Bob's long-term private key, they still cannot decrypt past sessions. Each session's symmetric key was derived from an ephemeral DH exchange whose private exponents no longer exist.

Why TLS 1.3 removed static RSA key exchange

In old TLS 1.2, the client could encrypt a session key with the server's RSA public key. Years later, if the server's private key leaked, every recorded session could be decrypted retroactively. TLS 1.3 removed that option entirely. Every TLS 1.3 connection uses ephemeral (EC)DH for forward secrecy. This is one of the most important security wins of the last decade.

07

Where DH Lives Today

Diffie-Hellman is not the most famous algorithm in cryptography, but it is arguably the most ubiquitous. Almost every encrypted connection you make on a daily basis begins with a DH exchange whose result you never see.