Diffie-Hellman

Diffie-Hellman solved the founding problem of modern cryptography: two people who have never met can agree on a shared secret while an eavesdropper watches every byte they exchange. Every TLS handshake and every secure messenger you use rests on this idea, in its fast elliptic-curve form (ECDH).

The key-exchange idea

Each party generates a keypair. They swap public keys in the open. Then each combines their own private key with the other’s public key, and by the math of the curve, both arrive at the identical shared secret. The eavesdropper saw both public keys but cannot derive the secret, because that would require solving the discrete-log problem (see the sibling Elliptic Curves).

Alice private a, public A = a*G          Bob private b, public B = b*G
        --------- A ------->
        <-------- B --------
Alice computes a*B = a*b*G          Bob computes b*A = b*a*G
        both hold the same secret a*b*G

Hands-on: ECDH with X25519

cd ~/crypto-lab
# Two parties each generate an X25519 keypair
openssl genpkey -algorithm x25519 -out alice.pem
openssl pkey -in alice.pem -pubout -out alice.pub.pem
openssl genpkey -algorithm x25519 -out bob.pem
openssl pkey -in bob.pem -pubout -out bob.pub.pem

# Alice derives the shared secret from her private key + Bob's public key
openssl pkeyutl -derive -inkey alice.pem -peerkey bob.pub.pem -out alice.ss
# Bob derives from his private key + Alice's public key
openssl pkeyutl -derive -inkey bob.pem -peerkey alice.pub.pem -out bob.ss

# The two secrets must be identical
diff alice.ss bob.ss && echo "shared secret matches"
sha256sum alice.ss

Expected output:

shared secret matches
9f2c1e...  alice.ss

Both sides computed the same 32-byte secret without ever transmitting it. In practice you would run that raw secret through a KDF (like HKDF) before using it as an encryption key.

Ephemeral keys and forward secrecy

If both parties reuse long-term DH keys forever, an attacker who records the traffic today and steals a private key next year can retroactively derive every past shared secret and decrypt everything.

The fix is ephemeral Diffie-Hellman (ECDHE): generate a brand-new throwaway keypair for each session and discard it afterward. This gives forward secrecy: because the ephemeral private keys no longer exist, a future compromise of long-term keys cannot unlock past sessions. TLS 1.3 makes ephemeral exchange mandatory for exactly this reason.

Mode	Keys	Forward secrecy
Static DH	Long-term, reused	No: one key theft exposes all past sessions
Ephemeral DH (ECDHE)	Fresh per session, discarded	Yes: past sessions stay safe

Man-in-the-middle and why DH needs authentication

Diffie-Hellman by itself proves nothing about who is on the other end. An attacker sitting between Alice and Bob can run two separate exchanges, one with each, and relay traffic while reading it. Neither side notices, because each computed a perfectly valid shared secret, just with the attacker instead of the intended peer.

Alice <==DH==> Mallory <==DH==> Bob
      (secret 1)        (secret 2)

The defence is authentication: bind each public key to a verified identity so a swapped key is detected. In practice the ephemeral DH keys are signed by a long-term identity key (see the sibling Digital Signatures), or vouched for by a certificate. Confidentiality comes from the exchange; trust comes from the signature. You need both.

Practical Guidance

1. Use X25519 for key exchange by default; use ECDH P-256 only when a standard requires NIST curves.
2. Always use ephemeral keys (ECDHE) so you get forward secrecy. Do not reuse a DH keypair across sessions.
3. Never use a raw derived secret directly as a key. Run it through a KDF such as HKDF first.
4. Never deploy Diffie-Hellman without authentication. Sign the ephemeral keys or verify certificates to stop man-in-the-middle.
5. If you must use classic finite-field DH, use standardized groups of at least 3072 bits; prefer elliptic-curve DH instead.
6. Discard ephemeral private keys immediately after the handshake so a later compromise cannot recover them.