Tool 6 of 8

Diffie-Hellman key exchange

Two people who have never met can agree on a shared secret key while an eavesdropper hears everything they say, and the secret itself is never sent.

Your challengeExplain how Alice and Bob end up with the same secret without ever sending it, and why an attacker in the middle can still trick them.
Colour code: public: everyone, including Eve, sees it private: never leaves its owner shared secret: computed by both, never sent
Visualise

The paint-mixing analogy

Analogy, not real cryptography
Alice
Public channel
Eve
sees all public paint
Bob

Mixing paint is easy, but separating a mixture back into its colours is practically impossible. Real Diffie-Hellman uses a mathematical operation with the same property.

Experiment

Real key agreement with ECDH

Genuine ECDH P-256 Simulated network

ECDH (Elliptic-Curve Diffie-Hellman) is the modern form of Diffie-Hellman used in HTTPS. Every key below is genuinely generated by your browser.

Alice
Network Simulated
Eve's notebook
everything she observed
Bob
Experiment

Attack: Mallory in the middle

Genuine ECDH and AES-GCM Simulated interception

Eve only listens. Mallory is worse: she sits between Alice and Bob and can replace the messages they exchange.

Alice
thinks she talks to Bob
Mallory
intercepts and replaces
Bob
thinks he talks to Alice
Explain

Key ideas

Key agreement, not key transport

Nobody chooses the key and sends it. Both sides compute the same secret from their own private value and the other side's public value.

Public values

The agreed parameters (here the curve P-256) and each side's public value can be seen by anyone.

Private values

Each side's private value never leaves its device. Without at least one private value, the shared secret cannot be computed.

Ephemeral keys

HTTPS generates new Diffie-Hellman values for every connection. Even if a server's long-term key is stolen later, recorded traffic stays protected (forward secrecy).

No authentication

Basic Diffie-Hellman does not tell you who you share the secret with. A man in the middle can run one exchange with each side. The public values must be authenticated with signatures and certificates.

What is ECDH?

ECDH is Diffie-Hellman built on elliptic curves. Same idea, much shorter keys. The original 1976 version uses large numbers instead.

Common misconceptions

"Diffie-Hellman encrypts the messages."
It only produces a shared secret. That secret is then used to derive keys for symmetric encryption (Tool 3).
"The shared secret is sent in encrypted form."
It is never sent at all, in any form. Only public values travel.
"If I have a shared secret, I know who I am talking to."
Not without authentication: you may share it with Mallory.
Apply

Where you meet Diffie-Hellman

HTTPS (TLS 1.3)

Every HTTPS connection starts with an ephemeral (EC)DH exchange. The server signs it so the browser knows the exchange is really with that server.

VPNs

IPsec (IKE) and WireGuard use Diffie-Hellman to agree on tunnel keys.

Messaging apps

Signal, WhatsApp and others use repeated Diffie-Hellman exchanges so every message gets new keys.

SSH

Each SSH connection agrees on session keys with Diffie-Hellman, and the server's host key authenticates it. That is why SSH warns you when the host key changes.

Challenges

1. Eve's notebook

After the ECDH exchange, list everything in Eve's notebook. What is missing for her to compute the secret?

Show answer
Eve knows the curve and both public values. She lacks both private values. Combining her own private value with a public value gives a different secret, as the lab shows.
2. Spot the man in the middle

In the attack scenario, compare the secret Alice computed with the one Bob computed. How could they notice the attack?

Show answer
Their secrets differ, but they cannot compare them over the network without revealing them. They need authentication: Bob signs his public value with a key whose public part Alice trusts, through a certificate (Tools 7 and 8). Messaging apps let users compare "safety numbers" in person for the same reason.
3. New connection, new secret

Restart the ECDH exchange several times. Is the shared secret the same each time? Why is this useful?

Show answer
It is different every time, because new private values are generated. If one session's key leaks, other sessions are not affected.

Continue the journey