Diffie-Hellman Key Exchange: The Mathematics Explained

Elliptic Curve Diffie-Hellman (ECDH) is the elliptic curve equivalent of Diffie-Hellman. Both parties agree on an elliptic curve and generator point G. Each generates a private random number (a, b) and computes public keys by scalar multiplication (A = aG, B = bG). They exchange public keys, then each multiplies the received public key by their private number (Alice computes B×a, Bob computes A×b). Both arrive at the same shared secret point (a×b×G). The security relies on the elliptic curve discrete logarithm problem, which is believed to be harder than the traditional discrete logarithm problem. ECDH achieves equivalent security with much smaller key sizes (256-bit ECC keys provide security comparable to 3072-bit RSA keys), making it ideal for resource-constrained environments.

Elliptic Curve Diffie-Hellman combines traditional Diffie-Hellman with elliptic curve cryptography to reduce key sizes while maintaining equivalent security levels. A 224-bit elliptic curve key provides the same security as a 2048-bit RSA key. This dramatic reduction in key size results in faster computations and lower resource requirements, making elliptic curve cryptography particularly valuable for devices with limited processing power and memory constraints.

Diffie-Hellman is the simplest public key cryptography algorithm, enabling two parties to establish a shared secret over an insecure channel. The protocol involves agreeing on a large prime number and a generator, each party generating a private key, computing a public key by raising the generator to the power of their private key, exchanging public keys, and both parties computing the shared secret by raising the received public key to the power of their own private key. Elliptic Curve Diffie-Hellman (ECDH) operates in the elliptic curve domain, providing equivalent security with smaller key sizes. The curve is defined by three parameters: the curve equation (with A and B coefficients), a generator point G, and a prime modulus.

ECDH is a cryptographic key exchange protocol that enables two parties to securely establish a shared secret key over an insecure channel by performing calculations on points of an elliptic curve rather than using modular arithmetic; unlike traditional Diffie-Hellman which relies on the discrete logarithm problem, ECDH uses the elliptic curve discrete logarithm problem, providing equivalent security with significantly smaller key sizes and offering advantages such as better computational efficiency, resistance to index calculus attacks, and forward secrecy.

Ephemeral Diffie-Hellman (DHE) achieves perfect forward secrecy by using ephemeral (temporary) secret values that are discarded after session key establishment. In this protocol, Alice and Bob each generate random secret exponents (a and b), exchange their public values (g^a mod P and g^b mod P), and derive a shared session key (g^(ab) mod P). The critical security property is that once the session key is established, both parties discard their secret exponents. Even if an attacker later compromises either party's private key, they cannot compute the session key because solving the discrete logarithm problem (recovering a from g^a) is computationally infeasible. This provides forward secrecy while maintaining authentication.

Perfect Forward Secrecy (PFS) is a security property in TLS encryption that ensures session keys remain confidential even if long-term server private keys are compromised; it achieves this by using ephemeral Diffie-Hellman key exchange during the TLS handshake, where both client and server generate unique random numbers for each session to derive a shared premaster secret without relying on the server's private key, thereby preventing attackers from decrypting past communications even if they obtain the private key later.

Perfect Forward Secrecy (PFS) is a security property in TLS that prevents attackers from decrypting previously recorded encrypted sessions even if they later obtain the server's private key; this is achieved by using ephemeral Diffie-Hellman key exchange where each session generates unique temporary keys instead of relying on the server's long-term private key for encryption, ensuring that compromising the private key only affects future sessions rather than exposing past communications.

Forward secrecy ensures that compromising long-term private keys does not compromise past session keys. With Diffie-Hellman key exchange, ephemeral keys are generated for each session, and the premaster secret is derived from these ephemeral values rather than being directly encrypted. Even if an attacker later obtains the server's private key, they cannot derive past session keys because the ephemeral values are discarded after use. This property is required in TLS 1.3 and highly recommended for modern deployments.

Perfect Forward Secrecy (PFS) ensures that if a private key is compromised, past encrypted conversations cannot be decrypted. RSA key exchange lacks PFS because the same key encrypts all sessions. Diffie-Hellman provides PFS because each session generates a new ephemeral key. Ephemeral Diffie-Hellman with RSA (DHE-RSA) combines RSA authentication with Diffie-Hellman key exchange, providing both authentication and PFS. HMAC (Hash-based Message Authentication Code) prevents replay attacks by including a sequence number in each message. The HMAC function combines a secret key with the message (including sequence number, message type, length, and content) to produce a digest. The Pseudo-Random Function (PRF) generates shared secrets of arbitrary length from a master secret using recursive HMAC operations, allowing TLS to derive separate keys for different purposes.

RSA signatures involve hashing a message, applying padding, then raising to the decryption exponent D mod n. Verification raises the signature to E mod n. RSA security depends on integer factorization hardness, though no provable equivalence exists between factorization and breaking RSA. The mathematical foundations include Diffie-Hellman's discrete log (1976), RSA's integer factorization (1977), and elliptic curve discrete log (mid-1980s). These three assumptions underpin virtually all internet public key cryptography. Despite 47 years of study, the relationship between factorization and RSA security remains unproven, requiring increasingly larger key sizes as subexponential factoring algorithms improve.

RSA security is based on the computational difficulty of factoring large numbers. Given N (product of two large primes), it is infeasible to determine P and Q. If factoring were possible, one could derive the private key from the public key. A worldwide team cracked a 300-bit key in 8 months using 1600 computers. Each additional bit approximately doubles complexity. Diffie-Hellman key exchange allows two parties to agree on a shared secret key over an insecure channel without prior communication. The protocol involves agreeing on public numbers G and N, each generating random private numbers, and computing G^(XY) mod N as the shared secret. The security depends on the discrete logarithm problem being computationally intractable.

Modern cryptography rests on two fundamental mathematical problems: integer factorization and the discrete logarithm problem. Integer factorization—the difficulty of finding prime factors of a large composite number—underlies RSA security. The discrete logarithm problem—finding x given p, g, and h = g^x mod p—is the foundation of Diffie-Hellman key exchange and DSA. These problems are computationally infeasible for sufficiently large parameters, providing the security guarantees that enable practical cryptographic systems. The Diffie-Hellman protocol, published in 1976, allows two parties to establish a shared secret over an insecure channel without pre-shared secrets. Both parties agree on a prime p and base g, select private random numbers, compute public values, and exchange them. Each party then computes the shared secret using the other's public value. The security relies on the computational difficulty of solving the discrete logarithm problem, demonstrating how abstract mathematical research yields transformative practical technologies.

RSA security relies on three computationally hard problems: (1) integer factorization (recovering p and q from n), (2) computing Euler's totient function φ(n) without knowing p and q, and (3) solving discrete logarithms. These problems have no known efficient solutions for sufficiently large numbers, making RSA secure against practical attacks despite its simple mathematical operations.

RSA key generation begins with selecting two large prime numbers p and q. The modulus n is calculated as their product (n = p × q), and Euler's totient function φ(n) equals (p-1) × (q-1). These values form the basis for generating public and private keys. Diffie-Hellman enables two parties to establish a shared secret over an insecure channel without pre-shared keys. Both parties agree on a prime p and base g, then exchange public values derived from private exponents. Each computes the shared secret using the other's public value raised to their own private exponent. Using p=29, g=5, a=12, b=17 demonstrates how both parties arrive at the same shared secret of 24.