Diffie–Hellman
Two strangers agree on a shared secret over a fully public channel — the paint-mixing trick that launched public-key cryptography.
Diffie–Hellman
Diffie–Hellman key exchange solves a problem that sounds impossible: two people who have never met, shouting across a room full of eavesdroppers, end up holding the same secret number — and no listener can figure out what it is. Published in 1976 by Whitfield Diffie and Martin Hellman, it cracked open the field of Public-Key Cryptography.
It does not encrypt a message. It does something more fundamental: it lets Alice and Bob agree on a shared key over an open wire, which they can then feed into a fast symmetric cipher or a One-Time Pad.
The paint-mixing intuition
Forget numbers for a moment. Imagine mixing paint:
- Alice and Bob publicly agree on a common color — say yellow. Everyone, including the eavesdropper, sees it.
- Each secretly picks a private color and mixes it into the yellow. Alice makes one blend, Bob another. They swap these public blends in the open.
- Each stirs their own private color into the other's blend.
Both now hold yellow + Alice's secret + Bob's secret — the same mixture. The eavesdropper saw the two public blends but cannot un-mix paint to recover the private colors. Separating mixed paint is the "hard problem."
The math behind the paint
Replace paint with Modular Arithmetic and the trick becomes precise. Everyone agrees on a large prime p and a base g.
Alice keeps her secret exponent a private and sends A; Bob keeps b private and sends B. Now each raises what they received to their own secret:
Since g^{ba} = g^{ab}, they hold the same value — the shared secret s = g^{ab} \bmod p. The exponents commute; that is the whole engine.
What it is and isn't
Diffie–Hellman gives you confidentiality of a freshly agreed key, but on its own it does not tell Alice who is really on the other end — a "man in the middle" could exchange keys with each side separately. Pinning down identity needs a Digital Signature or a trusted public key. In practice DH establishes the session key, and signatures vouch for who you are talking to.