# What Is Diffie-Hellman? Definition and Examples

> Diffie-Hellman is a key-agreement method, published in 1976, that lets two parties derive a shared secret over a public channel without ever transmitting it.

Source: https://ssl.sh/glossary/diffie-hellman/
Last updated: 2026-11-10

Diffie-Hellman was published by Whitfield Diffie and Martin Hellman in 1976. In the classic finite-field form, both parties share a public prime p and generator g; each picks a private number, sends g raised to that number modulo p, and raises the value it receives to its own private number. Both end up with the same result, while an eavesdropper would have to solve the discrete logarithm problem. [ECDHE](https://ssl.sh/glossary/ecdhe/) is the same idea over an elliptic-curve group.

## Why it matters
Diffie-Hellman with fresh keys per connection (DHE or ECDHE) is how TLS achieves [forward secrecy](https://ssl.sh/glossary/forward-secrecy/). On its own, though, it does not authenticate anyone: an attacker in the middle could run separate exchanges with each side. TLS prevents this by having the server sign its DH values with its certificate key. Group size matters too: the [Logjam](https://ssl.sh/glossary/logjam/) attack in 2015 showed that 512-bit export-grade DH could be broken quickly and that widely shared 1024-bit groups were within reach of well-resourced attackers.

## Example
A toy exchange with tiny numbers (real groups use 2048-bit or larger primes, or elliptic curves):

```text
Public:  p = 23, g = 5
Alice:   a = 4   ->  A = 5^4 mod 23 = 4
Bob:     b = 3   ->  B = 5^3 mod 23 = 10
Alice:   B^a mod 23 = 10^4 mod 23 = 18
Bob:     A^b mod 23 = 4^3  mod 23 = 18   (shared secret)
```

## Common misconceptions
- **"Diffie-Hellman encrypts the data."** It only produces a shared secret; a symmetric cipher such as AES-GCM encrypts the traffic with keys derived from it.
- **"Diffie-Hellman alone stops man-in-the-middle attacks."** Unauthenticated DH can be intercepted; certificates and signatures provide the authentication.
- **"Custom, very large DH groups are always better."** Standard 2048-bit groups are considered safe, larger groups slow every handshake, and most servers now prefer ECDHE anyway.

## Related terms

- [ECDHE](https://ssl.sh/zh/glossary/ecdhe/): ECDHE 是椭圆曲线上的临时 Diffie-Hellman 密钥交换，TLS 双方每次握手都生成新的椭圆曲线密钥对，并据此协商出共享密钥。
- [DH 参数](https://ssl.sh/zh/glossary/dh-parameters/): DH 参数是定义有限域 Diffie-Hellman 群的大素数模数和生成元，TLS 服务器要提供 DHE 密码套件就必须配置它。
- [密钥交换](https://ssl.sh/zh/glossary/key-exchange/): 密钥交换是 TLS 握手中客户端与服务器建立共享秘密的步骤，保护连接的对称密钥都由这个共享秘密派生而来。
- [前向保密](https://ssl.sh/zh/glossary/forward-secrecy/): 前向保密是密钥交换的一种安全属性：即使服务器的长期私钥日后泄露，过去连接的会话密钥也不会因此暴露。
- [Logjam](https://ssl.sh/zh/glossary/logjam/): Logjam 是 2015 年公布的攻击（CVE-2015-4000），可把 TLS 降级到 512 位出口级 Diffie-Hellman，并威胁使用过小或被大量共用 DH 参数的服务器。
- [中间人攻击](https://ssl.sh/zh/glossary/man-in-the-middle/): 中间人攻击是指攻击者暗中插入通信双方之间，转发并可能篡改流量，而双方都以为自己在直接和对方通信。