# What Is ECDHE (Elliptic Curve Diffie-Hellman Ephemeral)?

> ECDHE (Elliptic Curve Diffie-Hellman Ephemeral) is a TLS key exchange in which both peers use fresh elliptic-curve key pairs for every handshake.

Source: https://ssl.sh/glossary/ecdhe/
Last updated: 2026-11-10

ECDHE is [Diffie-Hellman](https://ssl.sh/glossary/diffie-hellman/) key agreement performed over an elliptic-curve group, with "ephemeral" meaning that both sides generate a new private key for every handshake and discard it afterwards. Each side sends its public point, combines the peer's point with its own private scalar, and arrives at the same shared secret. In TLS 1.2 it appears in suite names such as ECDHE-RSA-AES128-GCM-SHA256; in TLS 1.3 the client sends a key_share for groups such as x25519 or secp256r1 ([P-256](https://ssl.sh/glossary/p-256/)) and the server answers with its own.

## Why it matters
Because the private keys exist only for one handshake, ECDHE provides [forward secrecy](https://ssl.sh/glossary/forward-secrecy/): a later compromise of the certificate's private key does not decrypt recorded sessions. It is also far cheaper than finite-field DHE at similar strength, since a 256-bit curve needs much smaller keys than a 3072-bit DH group. ECDHE is the key exchange behind almost all HTTPS connections today, and X25519 is the classical half of the post-quantum hybrid X25519MLKEM768.

## Example
Set the curve preference in nginx and check which group a server picks:

```nginx
ssl_ecdh_curve X25519:prime256v1:secp384r1;
```

```bash
openssl s_client -connect example.com:443 -groups X25519
```

With `-groups`, the handshake succeeds only if the server supports that group, and the connection summary names the negotiated group.

## Common misconceptions
- **"ECDHE needs an ECDSA certificate."** ECDHE handles key exchange; the server can still authenticate with RSA, as in ECDHE-RSA suites.
- **"Ephemeral means the server's key is temporary."** Only the key-exchange keys are temporary; the certificate key is long-term.
- **"ECDH and ECDHE are the same."** Static ECDH suites reused a fixed key from the certificate and gave no forward secrecy; TLS 1.3 removed them.

## Related terms

- [Diffie-Hellman](https://ssl.sh/zh/glossary/diffie-hellman/): Diffie-Hellman 是 1976 年提出的密钥协商方法，让通信双方在公开信道上各自算出相同的共享秘密，而无需传输这个秘密本身。
- [密钥交换](https://ssl.sh/zh/glossary/key-exchange/): 密钥交换是 TLS 握手中客户端与服务器建立共享秘密的步骤，保护连接的对称密钥都由这个共享秘密派生而来。
- [前向保密](https://ssl.sh/zh/glossary/forward-secrecy/): 前向保密是密钥交换的一种安全属性：即使服务器的长期私钥日后泄露，过去连接的会话密钥也不会因此暴露。
- [ECC](https://ssl.sh/zh/glossary/ecc/): ECC 即椭圆曲线密码学，是基于有限域上椭圆曲线代数结构的公钥密码技术，能用较短的密钥提供很高的安全强度。
- [P-256](https://ssl.sh/zh/glossary/p-256/): P-256 是 NIST 标准化的 256 位素数域椭圆曲线，也叫 secp256r1 或 prime256v1，广泛用于 ECDSA 证书和 ECDHE 密钥交换。
- [X25519MLKEM768](https://ssl.sh/zh/glossary/x25519mlkem768/): X25519MLKEM768 是把经典的 X25519 与后量子算法 ML-KEM-768 组合起来的 TLS 1.3 混合密钥交换群，Chrome 从 131 版起使用。
- [密码套件](https://ssl.sh/zh/glossary/cipher-suite/): 密码套件是 TLS 客户端和服务器协商使用的一组命名的加密算法组合，例如 TLS_AES_128_GCM_SHA256，决定连接用什么算法保护数据。