Title: Diffe-Hellman Key Exchange
Course: Introduction to SSL/PKI > Section: Miscellaneous

Diffe-Hellman Key Exchange

Introduction

Diffie-Hellman (D-H) key exchange is a cryptographic protocol that allows two parties that have no prior knowledge of each other to jointly establish a shared secret key over an insecure communications channel. This key can then be used to encrypt subsequent communications using a symmetric key cipher. From: Wikipedia

In other workds, I don't know you, and you don't know me. We have nothing in common. So, how do we create a session (encryption) key so we can communicate securely?

How Does It Work?

Alice and Bob want to create a unique session key so they can exchange data securely.

Step 1

Alice creates a session key for secure communications. She “locks” it in a trunk (with a private key) and sends the trunk to Bob.

Note: It not really a trunk. It is a message or file which which is encrypted with a key only Alice has.

Step 2

Bob “locks” the trunk (with a private key) and sends the “doubly” locked trunk back to Alice.

Step 3

Alice removes her “lock” from the trunk and sends the “locked” trunk back to Bob.

Step 4

Bob remove his "lock" from the trunk and extracts the session key.

Step 5

Bob and Alice now have a shared private session key for secure communications.

Note: The creation of a session key does not provide any identifying information. After the session is started, each side should verify who is on the other end of the connection. (username/password, etc.)

Simple (not-real) Example

Diffie-Hellman (D-H) key exchange uses a mathematical function that is extremely difficult break (factor). The following example uses addition and subtraction to simplify the example and make the process clear.

Note: Addition and subtraction are not used for "real" Diffe-Hellman key exchanges.