Diffie-Hellman Key Exchange

How two parties agree on a shared secret over a public channel, without ever sending the secret itself

PUBLIC PARAMETERS (safe for anyone, including an eavesdropper, to see) • g = generator (a small public number) • p = a large public prime number — both agreed on openly, before any secret exists Start 1 👤 Alice & Bob (separately) Pick Private Secrets Alice picks a, Bob picks b kept secret, never sent 2 ⚡ Computed locally Compute Public Values A = g^a mod p B = g^b mod p 3 🔗 Public Channel Exchange A and B Alice sends A, Bob sends B eavesdropper sees both 4 ⚡ Computed locally Compute Shared Secret Alice: B^a mod p Bob: A^b mod p — same K Shared Secret K used as the AES key 👁 What an eavesdropper watching the whole exchange actually sees: g, p, A, and B — plenty of public data, but not a or b. Recovering the secrets from these public values means solving the discrete logarithm problem, which is computationally infeasible for well-chosen p. Legend Private / local step Local computation Sent over public channel Start / End

Prerequisites

  • • A shared generator g and prime p, agreed publicly
  • • No pre-existing secret channel required

Inputs → Outputs

  • • Input: public g, p + each party's private secret
  • • Output: identical shared secret K on both sides
  • • K typically feeds directly into AES-GCM

Real-World Usage

  • • ECDHE — the TLS 1.3 handshake key exchange
  • • SSH session key negotiation
  • • Signal / WhatsApp end-to-end encryption setup

Diffie-Hellman Key Exchange • Encryption Crash Course • ethical-hacking