Imagine having to agree on a password with someone you have never met, writing only on a blackboard that anyone can read. It seems impossible: everything you write is public. Yet that is exactly what the Diffie-Hellman key exchange makes possible, published in 1976 by Whitfield Diffie and Martin Hellman. It is one of the most elegant ideas in modern cryptography, and you use it every time you open a website over HTTPS.
The paint analogy
An intuitive way to understand it uses paint.
- Anna and Bruno publicly agree on a base colour, say yellow.
- Each secretly picks their own colour: Anna red, Bruno blue.
- Anna mixes the yellow with her red and sends Bruno the result, an orange. Bruno mixes the yellow with his blue and sends Anna a green.
- Anna adds her own red to the green she received; Bruno adds his own blue to the orange he received.
Both end up with the same final colour: yellow, red and blue mixed together. Anyone watching the exchange saw the yellow, the orange and the green, but cannot "unmix" the colours to discover the secret red or blue, and therefore cannot obtain the final colour.
The analogy works because mixing colours is easy, while separating them is practically impossible. In mathematics we need an operation with the same property.
The mathematical version
The operation that is "easy one way, hard the other" is modular exponentiation: computing g to the power of a and taking the remainder of the division by a prime number p. Doing it is fast; working back to a from the result, the so-called discrete logarithm, is extremely hard when p is very large.
An example with small numbers
- Public values: the prime p = 23 and the base g = 5.
- Anna secretly picks a = 4 and computes 5⁴ = 625; the remainder of dividing by 23 is 4. She sends 4 to Bruno.
- Bruno secretly picks b = 3 and computes 5³ = 125; the remainder of dividing by 23 is 10. He sends 10 to Anna.
- Anna computes 10⁴ = 10000; the remainder of dividing by 23 is 18.
- Bruno computes 4³ = 64; the remainder of dividing by 23 is 18.
Both have obtained the shared secret 18, which was never transmitted. An observer knows 23, 5, 4 and 10, but to reach 18 they would have to work out a or b. With numbers thousands of bits long, this is not feasible.
The shared secret is not used directly as a key: it is fed into a derivation function that produces the symmetric keys used to encrypt the communication.
The weak point: who is on the other side?
Diffie-Hellman on its own guarantees that nobody watching the exchange can derive the secret. It does not, however, guarantee who you are sharing it with.
An attacker able to intercept and modify messages can sit in the middle: they run one exchange with Anna pretending to be Bruno and another with Bruno pretending to be Anna. They obtain two secrets, one for each side, and can read and relay everything. This is the classic man-in-the-middle attack.
The solution is to authenticate the exchange. In TLS, for example, the server signs its values with its certificate's private key; in encrypted messaging apps, identity keys are compared through safety numbers. Key exchange and authentication are two halves of the same protection.
Modern versions
Elliptic curve Diffie-Hellman
The same idea works with elliptic curves: instead of exponentiation, a point is multiplied by a number. This is called ECDH, and its most widespread variant, X25519, is now the default key exchange in many protocols. Keys are much shorter and computations faster than in the classical version.
Ephemeral keys and forward secrecy
If Anna and Bruno generate fresh secret values for every session and delete them immediately afterwards, the exchange is called ephemeral (DHE or ECDHE). The advantage is forward secrecy: even if a long-term key were stolen in the future, past sessions would remain protected, because the secrets that generated them no longer exist.
Mistakes to avoid
- Parameters that are too small: in 2015 the attack known as Logjam showed that many servers still accepted 512-bit Diffie-Hellman groups, a legacy of old export restrictions, and that these could be broken. Today at least 2048 bits are used for the classical version, or modern elliptic curves.
- Unchecked values: an implementation must check that received values are valid, otherwise it can be tricked into producing weak secrets.
- Unauthenticated exchange: without a signature or key verification, there is no protection against active interception.
In short
- Diffie-Hellman lets two parties agree on a secret over a public channel without ever transmitting it.
- It relies on the difficulty of the discrete logarithm, or its elliptic curve equivalent.
- On its own it does not protect against someone in the middle: the exchange must be authenticated.
- X25519 is the most widespread modern version; ephemeral keys provide forward secrecy.
- Small parameters and unchecked values are the mistakes to avoid.
