How Diffie–Hellman key exchange works
How two strangers can agree on a shared secret key while everyone listens in, and why that idea underpins much of secure internet traffic.
Written by Amili, an AI writer, from the sources listed below · 17 October 2026 · 4 min read
Diffie–Hellman key exchange lets two parties who have never met build a shared secret key over a public channel. Each keeps a private number, swaps a value derived from it, and combines what arrives with their own secret. An eavesdropper sees the traffic but cannot practically compute the key.
In short
- It solves the old problem of needing a secure courier before any secure conversation could begin.
- Its security rests on the discrete logarithm problem: easy to compute forwards, very hard to reverse.
- On its own it does not prove who the other party is, so it needs authentication on top.
- Throwaway (ephemeral) keys give forward secrecy in TLS.
- Its two authors, Diffie and Hellman, made it public in 1976.
What problem does Diffie–Hellman solve?
Encryption with a single shared key is fast and strong, but both sides need the same key first. For most of history that meant moving the key physically, for instance on paper lists carried by a trusted courier. If the key was intercepted on the way, every later message was exposed.
In 1976 two researchers, Whitfield Diffie and Martin Hellman, described a way around this. Their method lets two parties with no prior contact agree on a secret key over a channel anyone can read. The resulting key can then drive a conventional symmetric cipher. Hellman later suggested adding Ralph Merkle's name, since the idea of public key distribution was Merkle's.
How does the paint-mixing analogy work?
A common way to picture it uses paint. Alice and Bob agree in public on a starting colour, say yellow. Each privately picks a secret colour and mixes it with the yellow, then they swap the mixtures openly.
Each then adds their own secret colour to the mixture they received. Both end up with the same final colour, because the same three ingredients went in, just in a different order. Someone watching sees the yellow and the two swapped mixtures, but separating a mixture back into its parts is the hard step, so the final colour stays private.
What does it look like with real numbers?
The original form uses arithmetic modulo a prime p, with a base g. In a classroom-sized example, Alice and Bob agree publicly on p = 23 and g = 5. Alice secretly picks a = 4 and sends Bob 5 to the power 4, modulo 23, which is 4. Bob secretly picks b = 3 and sends Alice 5 cubed modulo 23, which is 10.
Alice raises Bob's 10 to her secret power 4, modulo 23, and gets 18. Bob raises Alice's 4 to his secret power 3, modulo 23, and also gets 18. That shared 18 is their key. Only a and b were secret; p, g, 4 and 10 all travelled in the open. With numbers this small an attacker could simply try every option, which is why real systems use primes of at least 2048 bits. Recovering a secret exponent from those public values is called the discrete logarithm problem, and no known classical method solves it quickly at that scale.
Where is it used?
Diffie–Hellman secures a range of internet services. In Transport Layer Security, the protocol behind secure web connections, its ephemeral modes (called DHE or EDH) create fresh key pairs for each session and discard the private parts afterwards. That gives forward secrecy: stealing a long-term key later does not unlock past conversations.
Many variants exist. Elliptic curve Diffie–Hellman performs the same dance with points on an elliptic curve instead of numbers modulo a prime. The Signal Protocol uses an extended triple form, X3DH, which offers forward secrecy and deniability. The method also stretches to groups: three or more people can each apply their private exponent in turn until everyone holds the same secret.
Where can it fail?
The exchange alone does not establish who is on the other end. An attacker who can both read and alter messages can sit in the middle, run one exchange with Alice and another with Bob, and relay everything between them. That is why Diffie–Hellman is used as a building block inside authenticated protocols, often backed by certificates from a trusted authority.
Parameters matter too. Research published in October 2015 suggested that many internet services were then using settings too weak to resist very well-funded attackers, such as some national security agencies. And a variant meant to resist quantum computers, supersingular isogeny key exchange, was broken in July 2022.
What does it teach about thinking?
Diffie–Hellman shows that secrecy does not require a secret channel, only an operation that is cheap to perform and hard to undo. Much of modern security is built on such one-way steps. It also shows the value of separating problems: agreeing on a key and confirming identity are different jobs, and treating them as one is where attacks find room.
Questions people ask
Is Diffie–Hellman the same as RSA?
No. Diffie–Hellman is a way for two parties to agree on a shared secret key. RSA, which followed shortly after, is a public-key cryptosystem that can encrypt messages and sign them using a pair of keys. Both belong to public-key cryptography, but they do different jobs and rest on different hard mathematical problems.
Why can't an eavesdropper work out the key?
The eavesdropper sees the shared base, the modulus and both exchanged values, but not either private exponent. Computing the key from those public values amounts to solving the discrete logarithm problem. With a large enough prime, no known classical algorithm can do that in a practical amount of time, even on very powerful computers.
Does Diffie–Hellman protect against man-in-the-middle attacks?
Not by itself. The basic exchange has no way to confirm who sent each value, so an attacker who can change messages can impersonate both sides. Real systems pair it with authentication, such as digital certificates, so each party can check that the public value really came from the expected partner.
The thinking behind it
It tells the history of cryptography up to and including public-key methods like this one.
Read or listen to The Code Book
Hear the whole book free: start an Audible trial and your first audiobook — this one, if you like — is on the house.
As an Amazon Associate, ReadGlobe earns from qualifying purchases and Audible trials — at no extra cost to you.
Sources
- Diffie–Hellman key exchange — Wikipedia
- Key exchange — Wikipedia
- New Directions in Cryptography — Stanford University
How this was made: Amili, an AI writer, wrote this article in its own words from the sources above. Every link was checked before publishing. Spotted an error? Tell us and we will correct it.