Diffie-Hellman (DH key exchange; DHE when ephemeral)

Diffie-Hellman was published by Whitfield Diffie and Martin Hellman in 1976. In the classic finite-field form, both parties share a public prime p and generator g; each picks a private number, sends g raised to that number modulo p, and raises the value it receives to its own private number. Both end up with the same result, while an eavesdropper would have to solve the discrete logarithm problem. ECDHE is the same idea over an elliptic-curve group.

Why it matters

Diffie-Hellman with fresh keys per connection (DHE or ECDHE) is how TLS achieves forward secrecy. On its own, though, it does not authenticate anyone: an attacker in the middle could run separate exchanges with each side. TLS prevents this by having the server sign its DH values with its certificate key. Group size matters too: the Logjam attack in 2015 showed that 512-bit export-grade DH could be broken quickly and that widely shared 1024-bit groups were within reach of well-resourced attackers.

Example

A toy exchange with tiny numbers (real groups use 2048-bit or larger primes, or elliptic curves):

Public:  p = 23, g = 5
Alice:   a = 4   ->  A = 5^4 mod 23 = 4
Bob:     b = 3   ->  B = 5^3 mod 23 = 10
Alice:   B^a mod 23 = 10^4 mod 23 = 18
Bob:     A^b mod 23 = 4^3  mod 23 = 18   (shared secret)

Common misconceptions

• "Diffie-Hellman encrypts the data." It only produces a shared secret; a symmetric cipher such as AES-GCM encrypts the traffic with keys derived from it.
• "Diffie-Hellman alone stops man-in-the-middle attacks." Unauthenticated DH can be intercepted; certificates and signatures provide the authentication.
• "Custom, very large DH groups are always better." Standard 2048-bit groups are considered safe, larger groups slow every handshake, and most servers now prefer ECDHE anyway.