Diffie-Hellman

The Diffie-Hellman key agreement protocol (also just Diffie-Hellman or DH) allows two parties without any initial shared secret to create one in a manner immune to eavesdropping. Once they have done this, they can communicate privately by using that shared secret as a cryptographic key for a block cipher or a stream cipher, or as the basis for a further key exchange.

The protocol is secure against all passive attacks, but it is not at all resistant to active man-in-the-middle attacks. If a third party can impersonate Bob to Alice and vice versa, then no useful secret can be created. Authentication of the participants is a prerequisite for safe Diffie-Hellman key exchange. There are several ways to do the required authentication. For example, in Internet Key Exchange (IKE, defined in RFC 2409), authentication can be done with a shared secret or with any of several public key techniques. In Transport Layer Security (TLS, defined in RFC 2246), it is done by exchange of X.509 Certificates.

The Diffie-Hellman method is based on the discrete logarithm problem and is secure unless someone finds an efficient solution to that problem. It can use any of several variants of discrete log; common variants are over a field modulo a prime or a field defined by an elliptic curve.

Given a prime p and generator g (see discrete logarithm), Alice:

   * generates a random number a
   * calculates A = g^a modulo p
   * sends A to Bob

Meanwhile Bob:

   * generates a random number b
   * calculates B = g^b modulo p
   * sends B to Alice

Now Alice and Bob can both calculate the shared secret s = g^(ab). Alice knows a and B, so she calculates s = B^a. Bob knows A and b so he calculates s = A^b.

An eavesdropper will know p and g since these are made public, and can intercept A and B but, short of solving the discrete log problem, these do not let him or her discover the secret s.

The protocol can be subverted if either Alice or Bob uses a weak random number generator. The attacker can then make guesses at a or b; a correct guess breaks the system. If the random number generator is weak, the number of guesses required for this attack may not be prohibitive. However, with large p and a good random number generator, it is wildly impractical.