# What Is Key Exchange (key establishment, key agreement)?

> Key exchange is the TLS handshake step in which client and server establish a shared secret from which the connection's symmetric keys are derived.

Source: https://ssl.sh/glossary/key-exchange/
Last updated: 2026-11-10

Key exchange is how two parties end up holding the same secret without an eavesdropper learning it. TLS has used several methods: RSA key transport, where the client encrypts a random premaster secret with the server's RSA public key (TLS 1.2 and earlier only); ephemeral [Diffie-Hellman](https://ssl.sh/glossary/diffie-hellman/) key agreement, DHE or [ECDHE](https://ssl.sh/glossary/ecdhe/); pre-shared keys; and, most recently, hybrid schemes that add a post-quantum KEM. In TLS 1.3 the client lists its groups in supported_groups and sends key_share values for its likely choices; if the server wants a group the client did not send, it replies with a HelloRetryRequest, costing an extra round trip.

## Why it matters
The key exchange decides whether a connection has [forward secrecy](https://ssl.sh/glossary/forward-secrecy/) and whether it resists future quantum computers. With RSA key transport, anyone who later obtains the server's private key can decrypt every recorded session. The "harvest now, decrypt later" threat is why browsers moved to [hybrid key exchange](https://ssl.sh/glossary/hybrid-key-exchange/) such as X25519MLKEM768 before post-quantum certificates exist.

## Example
Common key exchange methods in TLS:

```text
Method              Protocols            Forward secrecy
RSA key transport   TLS 1.2 and older    No
DHE / ECDHE         TLS 1.2, TLS 1.3     Yes
PSK only            TLS 1.2, TLS 1.3     No
PSK with (EC)DHE    TLS 1.2, TLS 1.3     Yes
X25519MLKEM768      TLS 1.3              Yes, plus post-quantum
```

## Common misconceptions
- **"Key exchange and authentication are the same step."** Key exchange establishes the secret; signatures from the certificate key authenticate the server. RSA key transport merged the two, which is one reason TLS 1.3 dropped it.
- **"The cipher suite name always shows the key exchange."** That is true in TLS 1.2, but TLS 1.3 negotiates the group separately.
- **"A larger RSA certificate key strengthens the key exchange."** With ECDHE the certificate key only signs; the exchange's strength depends on the group.

## Related terms

- [ECDHE](https://ssl.sh/zh/glossary/ecdhe/): ECDHE 是椭圆曲线上的临时 Diffie-Hellman 密钥交换，TLS 双方每次握手都生成新的椭圆曲线密钥对，并据此协商出共享密钥。
- [Diffie-Hellman](https://ssl.sh/zh/glossary/diffie-hellman/): Diffie-Hellman 是 1976 年提出的密钥协商方法，让通信双方在公开信道上各自算出相同的共享秘密，而无需传输这个秘密本身。
- [RSA](https://ssl.sh/zh/glossary/rsa/): RSA 是 1977 年提出的公钥算法，TLS 用它对证书和握手进行签名，在 TLS 1.3 之前还用它传输会话密钥。
- [前向保密](https://ssl.sh/zh/glossary/forward-secrecy/): 前向保密是密钥交换的一种安全属性：即使服务器的长期私钥日后泄露，过去连接的会话密钥也不会因此暴露。
- [PSK](https://ssl.sh/zh/glossary/psk/): PSK（预共享密钥）是 TLS 双方在握手前就已共同持有的秘密，用于会话恢复，或在不使用证书的情况下完成身份认证。
- [混合密钥交换](https://ssl.sh/zh/glossary/hybrid-key-exchange/): 混合密钥交换把 X25519 等经典算法与 ML-KEM 等后量子 KEM 组合使用，只要其中一个未被攻破，得到的会话密钥就仍然安全。
- [TLS 握手](https://ssl.sh/zh/glossary/tls-handshake/): TLS 握手是 TLS 连接开始时的一组消息交换，客户端与服务器在其中协商协议版本和密码套件、验证服务器身份并派生会话密钥。