ECDHE (Elliptic Curve Diffie-Hellman Ephemeral)

ECDHE is Diffie-Hellman key agreement performed over an elliptic-curve group, with "ephemeral" meaning that both sides generate a new private key for every handshake and discard it afterwards. Each side sends its public point, combines the peer's point with its own private scalar, and arrives at the same shared secret. In TLS 1.2 it appears in suite names such as ECDHE-RSA-AES128-GCM-SHA256; in TLS 1.3 the client sends a key_share for groups such as x25519 or secp256r1 (P-256) and the server answers with its own.

Why it matters

Because the private keys exist only for one handshake, ECDHE provides forward secrecy: a later compromise of the certificate's private key does not decrypt recorded sessions. It is also far cheaper than finite-field DHE at similar strength, since a 256-bit curve needs much smaller keys than a 3072-bit DH group. ECDHE is the key exchange behind almost all HTTPS connections today, and X25519 is the classical half of the post-quantum hybrid X25519MLKEM768.

Example

Set the curve preference in nginx and check which group a server picks:

ssl_ecdh_curve X25519:prime256v1:secp384r1;

openssl s_client -connect example.com:443 -groups X25519

With -groups, the handshake succeeds only if the server supports that group, and the connection summary names the negotiated group.

Common misconceptions

• "ECDHE needs an ECDSA certificate." ECDHE handles key exchange; the server can still authenticate with RSA, as in ECDHE-RSA suites.
• "Ephemeral means the server's key is temporary." Only the key-exchange keys are temporary; the certificate key is long-term.
• "ECDH and ECDHE are the same." Static ECDH suites reused a fixed key from the certificate and gave no forward secrecy; TLS 1.3 removed them.