English
Menu

What is Diffie–Hellman key exchange?

A method by which two parties create a shared secret using only a public channel, published by Diffie and Hellman in 1976. A prime p and a generator g are public; A and B choose secret values a and b, send each other g^a mod p and g^b mod p, and each raises the other's value to their own secret, both obtaining the same g^(ab) mod p. Its security rests on the difficulty of the discrete logarithm problem. The version on an elliptic curve is ECDH, and versions using throwaway values for each connection are DHE and ECDHE, which provide forward secrecy. It does not authenticate the other party, so it is combined with signatures and certificates to prevent man-in-the-middle attacks.

Japanese name: ディフィー・ヘルマン鍵交換

Diffie–Hellman key exchange appears in 9 practice questions across 2 topics, including Applied Cryptography, Computer Networking Basics.

Field: Applied Cryptography

Try it: questions about Diffie–Hellman key exchange

In protocols such as TLS 1.3, the shared secret obtained from an ECDHE key exchange is not used directly as an encryption key; instead keys are made by passing it through a key derivation function (KDF) such as HKDF. Which of the following is an appropriate reason?

  1. APassing it through a key derivation function makes the shared secret secure even against quantum computers
  2. BThe value from the key exchange is too short, so the computation is deliberately made slow to slow down brute force
  3. CThe value from the key exchange is not necessarily uniformly random, so it is turned into an unbiased key, and separate keys are derived for each purpose
Show answer and explanation

Answer: C. The value from the key exchange is not necessarily uniformly random, so it is turned into an unbiased key, and separate keys are derived for each purpose

The shared secret obtained from a key exchange is, for example, the coordinate of a point on an elliptic curve, and not all of its bits are necessarily uniformly random. HKDF uses HMAC first to extract an unbiased pseudorandom key from the shared secret (Extract), and then expands it together with labels such as "client-to-server encryption" (Expand) to make as many keys of the required lengths as needed. Using independent keys for each purpose keeps a problem with one key from spreading to other purposes. PBKDF2 and Argon2, which derive keys from passwords, are deliberately slow, but HKDF is a light operation that assumes an input with sufficiently high entropy.

In Diffie–Hellman key exchange, a prime p and a generator g are public; A and B choose secret values a and b and send each other g^a mod p and g^b mod p. Which of the following is the reason an eavesdropper is believed unable to find the shared secret g^(ab) mod p even after seeing all these public values?

  1. AThe problem of finding a from g^a mod p (the discrete logarithm problem) is believed to be infeasible to solve efficiently when p is large
  2. Bg^a mod p and g^b mod p are further encrypted with the other party's public key before being sent, so the eavesdropper cannot read them
  3. CThe shared secret is made from a passphrase the two agreed on when they met in advance
Show answer and explanation

Answer: A. The problem of finding a from g^a mod p (the discrete logarithm problem) is believed to be infeasible to solve efficiently when p is large

Computing g^a mod p is fast, but finding a from the result is believed to be impossible in realistic time when p is large enough (the discrete logarithm problem). Even if the eavesdropper sees g^a mod p and g^b mod p, g^(ab) mod p cannot be formed without knowing a or b. Meanwhile, A just raises B's value to the power a and B raises A's value to the power b, and both obtain the same g^(ab) mod p. Doing the same on an elliptic curve is ECDH, which rests on the difficulty of the elliptic-curve discrete logarithm problem.

Diffie–Hellman key exchange in the explanations

Questions that mention Diffie–Hellman key exchange (9)

  1. In protocols such as TLS 1.3, the shared secret obtained from an ECDHE key exchange is not used directly as an encryption key; instead keys are made by passing it through a key derivation function (KDF) such as HKDF. Which of the following is an appropriate reason?
  2. In Diffie–Hellman key exchange, a prime p and a generator g are public; A and B choose secret values a and b and send each other g^a mod p and g^b mod p. Which of the following is the reason an eavesdropper is believed unable to find the shared secret g^(ab) mod p even after seeing all these public values?
  3. Diffie–Hellman key exchange is checked with small numbers. Let p = 23 and g = 5; A chooses the secret value a = 6 and B the secret value b = 15. A sends A = g^a mod p and B sends B = g^b mod p. Which of the following is the shared secret the two obtain?
  4. Which of the following is the correct combination of a weakness of Diffie–Hellman key exchange without authentication and its countermeasure?
  5. Which of the following correctly describes the idea of hybrid key exchange, used during the migration to post-quantum cryptography, that combines X25519 (Diffie–Hellman key exchange using an elliptic curve) with ML-KEM?
  6. In TLS, why can a browser conclude that the server it connects to is not an impostor?
  7. In TLS, which of the following key exchange methods provides the property that previously recorded communications cannot be decrypted even if the private key of the server certificate leaks later (forward secrecy)?
  8. Which of the following correctly describes a change from TLS 1.2 in TLS 1.3 (RFC 8446)?
  9. Which of the following is the correct combination of what the TLS 1.3 cipher suite TLS_AES_128_GCM_SHA256 specifies?

Books on Applied Cryptography Ad

As an Amazon Associate I earn from qualifying purchases.

Comparisons that include this term

Related terms

TLS RSA cryptosystem HMAC Modulo operation Forward secrecy Authenticated encryption (AEAD) Information entropy Post-quantum cryptography ML-KEM Certificate authority

Back to the glossary