Diffie-Hellman key exchange

Alice and Bob agree in public on a prime modulus p and a base g. Each picks a secret exponent and sends g raised to it, mod p; each then raises what the other sent to their own secret, and both land on the same number, written in RFC 2631 as ZZ = (yb ^ xa) mod p = (ya ^ xb) mod p ¹. Wikipedia's small example uses p = 23 and g = 5 ² and ends with a shared secret of 18 ³. The goal is a secret that stays unavailable to eavesdroppers ⁴, which then keys a fast symmetric cipher ⁵. Paint is the classic picture: anyone listening knows only the common color and the two mixes ⁶.

Eve sees p, g and both public values. Getting a secret exponent back from them is the discrete logarithm problem ¹, which is currently considered difficult when the group is large enough ²; Wikipedia recommends primes of at least 2048 bits ³. A fast discrete log algorithm would break this and many other public key systems ⁴, and Shor's algorithm on a quantum computer is one ⁵. The bare exchange also proves nothing about who is on the other end: it is non-authenticated, and serves as the basis for authenticated protocols ⁶.

TLS 1.3 lists (EC)DHE, Diffie-Hellman over finite fields or elliptic curves, as a key exchange mode ¹; implementations must support P-256 and should support X25519 ². Using fresh keys per session gives forward secrecy: the private keys are discarded once agreement is complete ³. Signal's X3DH runs several elliptic curve Diffie-Hellman exchanges on X25519 or X448 ⁴. The method was published by Whitfield Diffie and Martin Hellman in 1976 ⁵; Hellman counts Ralph Merkle as a co-inventor of public key cryptography ⁶.