How Diffie-Hellman Key Exchange Works

The key distribution problem

Symmetric encryption like AES is fast and secure, but requires both parties to already share a key. Before the internet, exchanging keys meant meeting in person or trusting a courier — impossible for millions of servers talking to billions of browsers. In 1976, Whitfield Diffie and Martin Hellman published New Directions in Cryptography, a protocol letting two parties derive an identical secret by exchanging only public information, without ever transmitting the key itself.

Paint mixing, made precise

The canonical intuition: mixing paint is easy, "unmixing" it is hard. Alice and Bob agree on a public prime p and generator g. Alice picks a secret a, Bob picks a secret b, and each computes a public value using modular exponentiation:

p = 23, g = 5   (public — Eve knows these too)
Alice: a = 6 (secret)  → A = 5⁶ mod 23 = 8   (sends A)
Bob:   b = 15 (secret) → B = 5¹⁵ mod 23 = 19 (sends B)

Alice computes: s = B^a mod p = 19⁶  mod 23 = 2
Bob computes:   s = A^b mod p = 8¹⁵ mod 23 = 2   ← same secret!

(g^a)^b mod p = (g^b)^a mod p = g^(ab) mod p

Both sides reach the same value because exponentiation over modular arithmetic is commutative — Alice computes (gᵇ)ᵃ, Bob computes (gᵃ)ᵇ, and they're identical. Real DH uses primes with 2048-4096 bits, not toy values like 23.

live demo · Alice and Bob converging on a shared secret Eve can't see● LIVE

Why it's hard to reverse: the discrete logarithm problem

Eve knows p, g, A and B. To crack the exchange she needs to find a such that gᵃ ≡ A (mod p) — the discrete logarithm problem (DLP). With ordinary integers this is trivial (if 5ᵃ = 3125, clearly a = 5), but modular "wraparound" destroys the pattern, and no efficient classical algorithm is known for solving it with large primes. With p = 23, Eve could brute-force a in milliseconds; with a real 2048-bit prime, the best known method — the General Number Field Sieve — would take longer than the age of the universe.

The catch: no authentication

Plain Diffie-Hellman has one critical weakness — it provides secrecy but not authentication. If Eve intercepts the connection from the start, she can run two separate DH exchanges, impersonating Bob to Alice and Alice to Bob, with both "secure" channels actually routing through her. This is why HTTPS pairs DH with a certificate: a signature from a trusted Certificate Authority confirming the server's public key really belongs to the domain you think you're visiting. Modern TLS 1.3 mandates DH-based (usually elliptic-curve ECDH) cipher suites specifically because they provide forward secrecy — each connection generates a fresh, ephemeral key pair, so recording today's traffic and later stealing the server's long-term key still can't decrypt old sessions.

Frequently asked questions

How does Diffie-Hellman let two parties agree on a secret without transmitting it?

Both parties combine a shared public base with their own private number using modular exponentiation, exchange only the results, then each raises the other's public result to their own private power. Because (g^a)^b mod p equals (g^b)^a mod p, both arrive at the identical value gab mod p without ever sending it across the channel.

Why is Diffie-Hellman hard to break?

An eavesdropper who knows g, p, and both public values A and B would need to solve the discrete logarithm problem — find a such that g^a ≡ A (mod p) — to recover a private key. No efficient classical algorithm is known for this with large primes; the best known method, the General Number Field Sieve, would take longer than the age of the universe for 2048-bit primes.

Does Diffie-Hellman alone protect against a man-in-the-middle attack?

No. Plain Diffie-Hellman provides secrecy but not authentication — an attacker who intercepts the connection at the start can run two separate exchanges, impersonating each party to the other. Real HTTPS pairs Diffie-Hellman with a certificate signed by a trusted Certificate Authority to verify identity.

Try it live

Everything above runs in your browser — open Diffie-Hellman Key Exchange and watch the colour-mixing analogy make the discrete logarithm problem intuitive, live.

▶ Open Diffie-Hellman simulation