View source for Diffie–Hellman key exchange

{{Short description|Method of exchanging cryptographic keys}}
[[File:DiffieHellman.png|409x409px|thumb|right|With Diffie–Hellman key exchange, two parties arrive at a common secret key, without passing the common secret key across the public channel.]]
'''Diffie–Hellman''' ('''DH''') '''key exchange'''<ref group="nb">Synonyms of Diffie–Hellman key exchange include:
* Diffie–Hellman–Merkle key exchange
* Diffie–Hellman key agreement
* Diffie–Hellman key establishment
* Diffie–Hellman key negotiation
* Exponential key exchange
* Diffie–Hellman protocol
* Diffie–Hellman handshake</ref> is a mathematical [[Key-agreement protocol|method]] of securely generating a symmetric [[cryptographic key]] over a public channel and was one of the first [[public-key cryptography|public-key protocols]] as conceived by [[Ralph Merkle]] and named after [[Whitfield Diffie]] and [[Martin Hellman]].<ref name="Merkle 1978">{{cite journal|last1=Merkle|first1=Ralph C.|date=April 1978|title=Secure Communications Over Insecure Channels|journal=[[Communications of the ACM]]|volume=21|issue=4|pages=294–299|doi=10.1145/359460.359473|quote=Received August, 1975; revised September 1977|citeseerx=10.1.1.364.5157|s2cid=6967714}}</ref><ref name="Diffie 1976" /> DH is one of the earliest practical examples of public key exchange implemented within the field of cryptography. Published in 1976 by Diffie and Hellman, this is the earliest publicly known work that proposed the idea of a private key and a corresponding public key.

Traditionally, secure encrypted communication between two parties required that they first exchange keys by some secure physical means, such as paper key lists transported by a trusted [[courier]]. The Diffie–Hellman key exchange method allows two parties that have no prior knowledge of each other to jointly establish a [[shared secret]] key over an [[insecure channel]]. This key can then be used to encrypt subsequent communications using a [[symmetric-key algorithm|symmetric-key]] [[cipher]].

Diffie–Hellman is used to secure a variety of [[Internet]] services. However, research published in October 2015 suggests that the parameters in use for many DH Internet applications at that time are not strong enough to prevent compromise by very well-funded attackers, such as the security services of some countries.<ref name=imperfectfs/>

The scheme was published by Whitfield Diffie and Martin Hellman in 1976,<ref name="Diffie 1976">{{cite journal|last1=Diffie|first1=Whitfield|last2=Hellman|first2=Martin E.|author-link2=Martin Hellman|date=November 1976|title=New Directions in Cryptography|url=http://ee.stanford.edu/%7Ehellman/publications/24.pdf|url-status=live|journal=[[IEEE Transactions on Information Theory]]|volume=22|issue=6|pages=644–654|doi=10.1109/TIT.1976.1055638|archive-url=https://web.archive.org/web/20141129035850/https://ee.stanford.edu/%7Ehellman/publications/24.pdf|archive-date=2014-11-29|author-link1=Whitfield Diffie|citeseerx=10.1.1.37.9720}}</ref> but in 1997 it was revealed that [[James H. Ellis]],<ref>{{cite web|url=http://cryptocellar.web.cern.ch/cryptocellar/cesg/possnse.pdf|title=The possibility of Non-Secret digital encryption|last1=Ellis|first1=J. H.|author-link=James H. Ellis|date=January 1970|work=CESG Research Report|archive-url=https://web.archive.org/web/20141030210530/https://cryptocellar.web.cern.ch/cryptocellar/cesg/possnse.pdf|archive-date=2014-10-30|url-status=dead|access-date=2015-08-28}}</ref> [[Clifford Cocks]], and [[Malcolm J. Williamson]] of [[Government Communications Headquarters|GCHQ]], the British signals intelligence agency, had previously shown in 1969<ref>{{cite web|url=https://www.gchq.gov.uk/sites/default/files/document_files/CESG_Research_Report_No_3006_0.pdf|title=The Possibility of Secure Secret Digital Encryption|archive-url=https://web.archive.org/web/20170216051636/https://www.gchq.gov.uk/sites/default/files/document_files/CESG_Research_Report_No_3006_0.pdf|archive-date=2017-02-16|url-status=live|access-date=2017-07-08}}</ref> how public-key cryptography could be achieved.<ref>{{cite news|url=https://www.bbc.co.uk/news/uk-england-gloucestershire-11475101|title=GCHQ trio recognised for key to secure shopping online|date=5 October 2010|work=[[BBC News]]|access-date=5 August 2014|archive-url=https://web.archive.org/web/20140810044800/http://www.bbc.co.uk/news/uk-england-gloucestershire-11475101|archive-date=10 August 2014|url-status=live}}</ref>

Although Diffie–Hellman key exchange itself is a non-authenticated [[key-agreement protocol]], it provides the basis for a variety of authenticated protocols, and is used to provide [[forward secrecy]] in [[Transport Layer Security]]'s [[ephemeral key|ephemeral]] modes (referred to as EDH or DHE depending on the [[cipher suite]]).

The method was followed shortly afterwards by [[RSA (algorithm)|RSA]], an implementation of public-key cryptography using asymmetric algorithms.

Expired US patent 4200770<ref>{{US patent reference|number=4200770}}</ref> from 1977 describes the now [[public domain|public-domain]] algorithm. It credits Hellman, Diffie, and Merkle as inventors.

== Name ==
In 2006, Hellman suggested the algorithm be called '''Diffie–Hellman–Merkle key exchange''' in recognition of [[Ralph Merkle]]'s contribution to the invention of [[public-key cryptography]] (Hellman, 2006), writing:

{{Blockquote|The system ... has since become known as Diffie–Hellman key exchange. While that system was first described in a paper by Diffie and me, it is a public key distribution system, a concept developed by Merkle, and hence should be called 'Diffie–Hellman–Merkle key exchange' if names are to be associated with it. I hope this small pulpit might help in that endeavor to recognize Merkle's equal contribution to the invention of public key cryptography.<ref name="Hellman2002">{{citation | last1=Hellman | first1=Martin E. | title=An overview of public key cryptography | journal=IEEE Communications Magazine | volume=40 | issue=5 | pages=42–49 | date=May 2002 | doi=10.1109/MCOM.2002.1006971 | url=http://www-ee.stanford.edu/~hellman/publications/31.pdf | url-status=live | archive-url=https://web.archive.org/web/20160402093741/http://www-ee.stanford.edu/%7Ehellman/publications/31.pdf | archive-date=2016-04-02 | citeseerx=10.1.1.127.2652 | s2cid=9504647 }}</ref>}}

== Description ==

=== General overview ===
[[File:Diffie-Hellman Key Exchange.svg|thumb|250px|Illustration of the concept behind Diffie–Hellman key exchange]]
Diffie–Hellman key exchange establishes a shared secret between two parties that can be used for secret communication for exchanging data over a public network. An analogy illustrates the concept of public key exchange by using colors instead of very large numbers:

The process begins by having the two parties, [[Alice and Bob]], publicly agree on an arbitrary starting color that does not need to be kept secret. In this example, the color is yellow. Each person also selects a secret color that they keep to themselves – in this case, red and cyan. The crucial part of the process is that Alice and Bob each mix their own secret color together with their mutually shared color, resulting in orange-tan and light-blue mixtures respectively, and then publicly exchange the two mixed colors. Finally, each of them mixes the color they received from the partner with their own private color. The result is a final color mixture (yellow-brown in this case) that is identical to their partner's final color mixture.

If a third party listened to the exchange, they would only know the common color (yellow) and the first mixed colors (orange-tan and light-blue), but it would be very hard for them to find out the final secret color (yellow-brown). Bringing the analogy back to a [[real-life]] exchange using large numbers rather than colors, this determination is computationally expensive. It is impossible to compute in a practical amount of time even for modern [[supercomputer]]s.

=== Cryptographic explanation ===
The simplest and the original implementation,<ref name="Diffie 1976" /> later formalized as '''Finite Field Diffie–Hellman''' in RFC 7919,<ref>{{cite book |title=Real World Cryptography |url=https://books.google.com/books?id=Qd5CEAAAQBAJ |chapter=Key exchange standards |last=Wong |first=David |publisher=Manning |year=2021 | isbn=9781617296710 |chapter-url=https://archive.today/20200921005545/https://freecontent.manning.com/key-exchange-standards/ |via=Google Books}}</ref> of the protocol uses the [[Multiplicative group of integers modulo n|multiplicative group of integers modulo]] ''p'', where ''p'' is [[prime number|prime]], and ''g'' is a [[Primitive root modulo n|primitive root modulo]] ''p''. To guard against potential vulnerabilities, it is recommended to use prime numbers of at least 2048 bits in length. This increases the difficulty for an adversary attempting to compute the discrete logarithm and compromise the shared secret. These two values are chosen in this way to ensure that the resulting shared secret can take on any value from 1 to {{nowrap|''p'' − 1}}. Here is an example of the protocol, with non-secret values in {{blue|blue}}, and secret values in '''{{red|red}}'''.
# [[Alice and Bob]] publicly agree to use a modulus ''{{blue|p}}'' = {{blue|23}} and base ''{{blue|g}}'' = {{blue|5}} (which is a primitive root modulo 23).
# Alice chooses a secret integer '''''{{red|a}}''''' = 4, then sends Bob ''{{blue|A}}'' = ''{{blue|g}}<sup>'''{{red|a}}'''</sup>'' mod ''{{blue|p}}''
#* ''{{blue|A}}'' = {{blue|5}}<sup>'''{{red|4}}'''</sup> mod {{blue|23}} = {{blue|4}} (in this example both ''{{blue|A}}'' and '''''{{red|a}}''''' have the same value 4, but this is usually not the case) 
# Bob chooses a secret integer '''''{{red|b}}''''' = 3, then sends Alice ''{{blue|B}}'' = ''{{blue|g}}<sup>'''{{red|b}}'''</sup>'' mod ''{{blue|p}}''
#* ''{{blue|B}}'' = {{blue|5}}<sup>'''{{red|3}}'''</sup> mod {{blue|23}} = {{blue|10}}
# Alice computes '''''{{red|s}}''''' = ''{{blue|B}}<sup>'''{{red|a}}'''</sup>'' mod ''{{blue|p}}''
#* '''''{{red|s}}''''' = {{blue|10}}<sup>'''{{red|4}}'''</sup> mod {{blue|23}} = '''{{red|18}}'''
# Bob computes '''''{{red|s}}''''' = ''{{blue|A}}<sup>'''{{red|b}}'''</sup>'' mod ''{{blue|p}}''
#* '''''{{red|s}}''''' = {{blue|4}}<sup>'''{{red|3}}'''</sup> mod {{blue|23}} = '''{{red|18}}'''
# Alice and Bob now share a secret (the number 18).

Both Alice and Bob have arrived at the same values because under mod ''p'',
: <math>{\color{Blue}A}^{\color{Red}\boldsymbol{b}}\bmod {\color{Blue}p} = {\color{Blue}g}^{\color{Red}\boldsymbol{ab}}\bmod {\color{Blue}p} = {\color{Blue}g}^{\color{Red}\boldsymbol{ba}}\bmod {\color{Blue}p} = {\color{Blue}B}^{\color{Red}\boldsymbol{a}}\bmod {\color{Blue}p}</math>

More specifically,
: <math>({\color{Blue}g}^{\color{Red}\boldsymbol{a}}\bmod {\color{Blue}p})^{\color{Red}\boldsymbol{b}}\bmod {\color{Blue}p} = ({\color{Blue}g}^{\color{Red}\boldsymbol{b}}\bmod {\color{Blue}p})^{\color{Red}\boldsymbol{a}}\bmod {\color{Blue}p}</math>

Only ''a'' and ''b'' are kept secret. All the other values – ''p'', ''g'', ''g<sup>a</sup>'' mod ''p'', and ''g<sup>b</sup>'' mod ''p'' – are sent in the clear. The strength of the scheme comes from the fact that ''g<sup>ab</sup>'' mod ''p'' = ''g<sup>ba</sup>'' mod ''p'' take extremely long times to compute by any known algorithm just from the knowledge of ''p'', ''g'', ''g<sup>a</sup>'' mod ''p'', and ''g<sup>b</sup>'' mod ''p''. Such a function that is easy to compute but hard to invert is called a [[one-way function]]. Once Alice and Bob compute the shared secret they can use it as an encryption key, known only to them, for sending messages across the same open communications channel.

Of course, much larger values of ''a'', ''b'', and ''p'' would be needed to make this example secure, since there are only 23 possible results of ''n'' mod 23. However, if ''p'' is a prime of at least 600 digits, then even the fastest modern computers using the fastest known algorithm cannot find ''a'' given only ''g'', ''p'' and ''g<sup>a</sup>'' mod ''p''. Such a problem is called the [[discrete logarithm problem]].<ref name=imperfectfs/> The computation of ''g<sup>a</sup>'' mod ''p'' is known as [[modular exponentiation]] and can be done efficiently even for large numbers.
Note that ''g'' need not be large at all, and in practice is usually a small integer (like 2, 3, ...).

=== Secrecy chart ===
The chart below depicts who knows what, again with non-secret values in {{blue|blue}}, and secret values in '''{{red|red}}'''. Here [[Alice and Bob#Cast of characters|Eve]] is an [[Eavesdropping#Network attacks|eavesdropper]] – she watches what is sent between Alice and Bob, but she does not alter the contents of their communications.
* ''<span style="color:blue">g</span>'', public (primitive root) base, known to Alice, Bob, and Eve. ''<span style="color:blue">g</span>'' = <span style="color:blue">5</span>
* ''<span style="color:blue">p</span>'', public (prime) modulus, known to Alice, Bob, and Eve. ''<span style="color:blue">p</span>'' = <span style="color:blue">23</span>
* '''''<span style="color:red">a</span>''''', Alice's private key, known only to Alice. '''''<span style="color:red">a</span>''''' = '''<span style="color:red">6</span>'''
* '''''<span style="color:red">b</span>''''', Bob's private key known only to Bob. '''''<span style="color:red">b</span>''''' = '''<span style="color:red">15</span>'''
* ''<span style="color:blue">A</span>'', Alice's public key, known to Alice, Bob, and Eve. ''<span style="color:blue">A</span>'' = ''<span style="color:blue">g</span><sup>'''<span style="color:red">a</span>'''</sup>'' mod ''<span style="color:blue">p</span>'' = <span style="color:blue">8</span>
* ''<span style="color:blue">B</span>'', Bob's public key, known to Alice, Bob, and Eve. ''<span style="color:blue">B</span>'' = ''<span style="color:blue">g</span><sup>'''<span style="color:red">b</span>'''</sup>'' mod ''<span style="color:blue">p</span>'' = <span style="color:blue">19</span>

{| border="0" cellspacing="0" cellpadding="2"
|-
| valign="top" |
{| class="wikitable"
|+ Alice
|- style="text-align:center;" 
! Known
! Unknown
|-
| ''<span style="color:blue">p</span>'' = <span style="color:blue">23</span>
|
|-
| ''<span style="color:blue">g</span>'' = <span style="color:blue">5</span>
|
|-
| '''''<span style="color:red">a</span>''''' = '''<span style="color:red">6</span>'''
| '''''<span style="color:red">b</span>'''''
|-
| ''<span style="color:blue">A</span>'' = <span style="color:blue">5</span><sup>'''''<span style="color:red">a</span>'''''</sup> mod <span style="color:blue">23</span>
|
|-
| ''<span style="color:blue">A</span>'' = <span style="color:blue">5</span><sup>'''<span style="color:red">6</span>'''</sup> mod <span style="color:blue">23</span> = <span style="color:blue">8</span>
|
|-
| ''<span style="color:blue">B</span>'' = <span style="color:blue">19</span>
| 
|-
| '''''<span style="color:red">s</span>''''' = <span style="color:blue">B</span><sup>'''''<span style="color:red">a</span>'''''</sup> mod <span style="color:blue">23</span>
|
|-
| '''''<span style="color:red">s</span>''''' = <span style="color:blue">19</span><sup>'''<span style="color:red">6</span>'''</sup> mod <span style="color:blue">23</span> = '''<span style="color:red">2</span>'''
|
|}
| valign="top" | 
{| class="wikitable"
|+ Bob
|- style="text-align:center;" 
! Known
! Unknown
|-
| ''<span style="color:blue">p</span>'' = <span style="color:blue">23</span>
|
|-
| ''<span style="color:blue">g</span>'' = <span style="color:blue">5</span>
|
|-
| '''''<span style="color:red">b</span>''''' = '''<span style="color:red">15</span>'''
| '''''<span style="color:red">a</span>'''''
|-
| ''<span style="color:blue">B</span>'' = <span style="color:blue">5</span><sup>'''''<span style="color:red">b</span>'''''</sup> mod <span style="color:blue">23</span>
|
|-
| ''<span style="color:blue">B</span>'' = <span style="color:blue">5</span><sup>'''<span style="color:red">15</span>'''</sup> mod <span style="color:blue">23</span> = <span style="color:blue">19</span>
|
|-
| ''<span style="color:blue">A</span>'' = <span style="color:blue">8</span>
| 
|-
| '''''<span style="color:red">s</span>''''' = <span style="color:blue">A</span><sup>'''''<span style="color:red">b</span>'''''</sup> mod <span style="color:blue">23</span>
|
|-
| '''''<span style="color:red">s</span>''''' = <span style="color:blue">8</span><sup>'''<span style="color:red">15</span>'''</sup> mod <span style="color:blue">23</span> = '''<span style="color:red">2</span>'''
|
|}
| valign="top" | 
{| class="wikitable"
|+ Eve
|- style="text-align:center;" 
! Known
! Unknown
|-
| ''<span style="color:blue">p</span>'' = <span style="color:blue">23</span>
|
|-
| ''<span style="color:blue">g</span>'' = <span style="color:blue">5</span>
|
|-
|
| '''''<span style="color:red">a</span>''''', '''''<span style="color:red">b</span>'''''
|-
| &nbsp;
| &nbsp;
|-
| &nbsp;
| &nbsp;
|-
| ''<span style="color:blue">A</span>'' = <span style="color:blue">8</span>, ''<span style="color:blue">B</span>'' = <span style="color:blue">19</span>
| 
|-
| &nbsp;
| &nbsp;
|-
|
| '''''<span style="color:red">s</span>'''''
|}
|}

Now '''''<span style="color:red">s</span>''''' is the shared secret key and it is known to both Alice and Bob, but ''not'' to Eve. Note that it is not helpful for Eve to compute ''<span style="color:blue">AB</span>'', which equals ''<span style="color:blue">g</span>''<sup>'''''<span style="color:red">a</span>'''''+'''''<span style="color:red">b</span>'''''</sup> mod <span style="color:blue">p</span>.

Note: It should be difficult for Alice to solve for Bob's private key or for Bob to solve for Alice's private key. If it is not difficult for Alice to solve for Bob's private key (or vice versa), then an eavesdropper, [[Alice and Bob#Cast of characters|Eve]], may simply substitute her own private / public key pair, plug Bob's public key into her private key, produce a fake shared secret key, and solve for Bob's private key (and use that to solve for the shared secret key). [[Alice and Bob#Cast of characters|Eve]] may attempt to choose a public / private key pair that will make it easy for her to solve for Bob's private key.

=== Generalization to finite cyclic groups ===
Here is a more general description of the protocol:<ref>{{cite book|url=https://books.google.com/books?id=BuQlBQAAQBAJ&pg=PA190|title=Introduction to Cryptography|last=Buchmann|first=Johannes A.|publisher=Springer Science+Business Media|year=2013|isbn=978-1-4419-9003-7|edition=Second|pages=190–191}}</ref>
# Alice and Bob agree on a natural number ''n'' and a [[Generating set of a group|generating]] element ''g'' in the finite [[cyclic group]] ''G'' of order ''n''. (This is usually done long before the rest of the protocol; ''g'' and ''n'' are assumed to be known by all attackers.) The group ''G'' is written multiplicatively.
# Alice picks a random [[natural number]] ''a'' with 1 < ''a'' < ''n'', and sends the element ''g<sup>a</sup>'' of ''G'' to Bob.
# Bob picks a random natural number ''b'' with 1 < ''b'' < ''n'', and sends the element ''g<sup>b</sup>'' of ''G'' to Alice.
# Alice computes the element {{math|1=(''g<sup>b</sup>'')<sup>''a''</sup> = ''g<sup>ba</sup>''}} of G.
# Bob computes the element {{math|1=(''g<sup>a</sup>'')<sup>''b''</sup> = ''g<sup>ab</sup>''}} of G.

Both Alice and Bob are now in possession of the group element ''g<sup>ab</sup>'' = ''g<sup>ba</sup>'', which can serve as the shared secret key. The group ''G'' satisfies the requisite condition for [[secure communication]] as long as there is no efficient algorithm for determining ''g<sup>ab</sup>'' given ''g'', ''g<sup>a</sup>'', and ''g<sup>b</sup>''.

For example, the [[Elliptic-curve Diffie–Hellman|elliptic curve Diffie–Hellman]] protocol is a variant that represents an element of G as a point on an elliptic curve instead of as an integer modulo n.&nbsp;Variants using [[Hyperelliptic curve cryptography|hyperelliptic curves]] have also been proposed. The [[supersingular isogeny key exchange]] is a Diffie–Hellman variant that was designed to be secure against [[quantum computers]], but it was broken in July 2022.<ref name=castryckdecru2023>{{cite journal|last1=Castryck|first1=Wouter|last2=Decru|first2=Thomas|date=April 2023|title=An efficient key recovery attack on SIDH|journal=Annual International Conference on the Theory and Applications of Cryptographic Techniques|pages=423–447|url=https://eprint.iacr.org/2022/975.pdf|archive-url=https://web.archive.org/web/20240926174200/https://eprint.iacr.org/2022/975.pdf|archive-date=2024-09-26}}</ref>

== Ephemeral and/or static keys ==
The used keys can either be ephemeral or static (long term) key, but could even be mixed, so called semi-static DH. These variants have different properties and hence different use cases. An overview over many variants and some also discussions can for example be found in NIST SP 800-56A.<ref>{{cite report |url=https://csrc.nist.gov/Pubs/sp/800/56/a/r3/Final |title=Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography |last1=Barker |first1=Elaine |last2=Chen |first2=Lily |date=2018-04-16 |publisher=National Institute of Standards and Technology |issue=NIST Special Publication (SP) 800-56A Rev. 3 |language=en |last3=Roginsky |first3=Allen |last4=Vassilev |first4=Apostol |last5=Davis |first5=Richard}}</ref> A basic list:
# ephemeral, ephemeral: Usually used for key agreement. Provides [[forward secrecy]], but no [[Authentication|authenticity]].
# static, static: Would generate a long term shared secret. Does not provide forward secrecy, but implicit authenticity. Since the keys are static it would for example not protect against [[Replay attack|replay-attacks]].
# ephemeral, static: For example, used in [[ElGamal encryption]] or [[Integrated Encryption Scheme|Integrated Encryption Scheme (IES)]]. If used in key agreement it could provide implicit one-sided authenticity (the ephemeral side could verify the authenticity of the static side). No forward secrecy is provided.

It is possible to use ephemeral and static keys in one key agreement to provide more security as for example shown in NIST SP 800-56A, but it is also possible to combine those in a single DH key exchange, which is then called triple DH (3-DH).

=== Triple Diffie–Hellman (3-DH) ===
In 1997 a kind of triple DH was proposed by Simon Blake-Wilson, Don Johnson, Alfred Menezes in 1997,<ref>{{citation|last1=Blake-Wilson|first1=Simon|chapter=Key Agreement Protocols and their Security Analysis|year=1997|last2=Johnson|first2=Don|last3=Menezes|first3=Alfred|title=Crytography and Coding |series=Lecture Notes in Computer Science |volume=1355 |pages=30–45 |citeseerx=10.1.1.25.387|doi=10.1007/BFb0024447|isbn=978-3-540-63927-5 }}</ref> which was improved by C. Kudla and K. G. Paterson in 2005<ref>{{cite book|last1=Kudla|first1=Caroline|last2=Paterson|first2=Kenneth G.|title=Advances in Cryptology - ASIACRYPT 2005 |chapter=Modular Security Proofs for Key Agreement Protocols |year=2005|editor-last=Roy|editor-first=Bimal|series=Lecture Notes in Computer Science|volume=3788 |language=en|location=Berlin, Heidelberg|publisher=Springer|pages=549–565|doi=10.1007/11593447_30|isbn=978-3-540-32267-2 |doi-access=free|url=https://iacr.org/archive/asiacrypt2005/546/546.pdf}}</ref> and shown to be secure.

The long term secret keys of Alice and Bob are denoted by ''a'' and ''b'' respectively, with public keys ''A'' and ''B'', as well as the ephemeral key pairs (''x'', ''X'') and (''y'', ''Y''). Then protocol is:
{| class="wikitable"
|+ Triple Diffie–Hellman (3-DH) protocol
! Alice (<math>A = g^a</math>)
!
! Bob (<math>B = g^b</math>)
|-
| <math>X = g^x</math>
| <math>X \rightarrow {}</math>
|
|-
|
| <math>{} \leftarrow Y</math>
| <math>Y = g^y</math>
|-
| <math>K = \operatorname{KDF}\left( Y^x,\, B^x,\, Y^a,\, X,\, Y,\, A,\, B \right)</math>
|
| <math>K = \operatorname{KDF}\left( X^y,\, X^b,\, A^y,\, X,\, Y,\, A,\, B \right)</math>
|}
The long term public keys need to be transferred somehow. That can be done beforehand in a separate, trusted channel, or the public keys can be encrypted using some partial key agreement to preserve anonymity. For more of such details as well as other improvements like [[Side-channel attack|side channel protection]] or explicit [[Key (cryptography)|key confirmation]], as well as early messages and additional password authentication, see e.g. US patent "Advanced modular handshake for key agreement and optional authentication".<ref>{{cite patent|number=US11025421B2|title=Advanced modular handshake for key agreement and optional authentication|gdate=2021-06-01|invent1=Fay|inventor1-first=Bjorn|url=https://patents.google.com/patent/US11025421B2/en?oq=11025421}}</ref>

=== Extended Triple Diffie–Hellman (X3DH) ===
X3DH was initially proposed as part of the [[Double Ratchet Algorithm]] used in the [[Signal Protocol]]. The protocol offers forward secrecy and cryptographic deniability. It operates on an elliptic curve.<ref name=x3dh>{{cite web |title=Specifications >> The X3DH Key Agreement Protocol |url=https://www.signal.org/docs/specifications/x3dh/ |website=Signal Messenger |language=en}}</ref>

The protocol uses five public keys. Alice has an identity key IK<sub>A</sub> and an ephemeral key EK<sub>A</sub>. Bob has an identity key IK<sub>B</sub>, a signed prekey SPK<sub>B</sub>, and a one-time prekey OPK<sub>B</sub>.<ref name=x3dh/> Bob first publishes his three keys to a server, which Alice downloads and verifies the signature on. Alice then initiates the exchange to Bob.<ref name=x3dh/> The OPK is optional.<ref name=x3dh/>

== Operation with more than two parties ==
Diffie–Hellman key agreement is not limited to negotiating a key shared by only two participants. Any number of users can take part in an agreement by performing iterations of the agreement protocol and exchanging intermediate data (which does not itself need to be kept secret). For example, Alice, Bob, and Carol could participate in a Diffie–Hellman agreement as follows, with all operations taken to be modulo ''p'':
# The parties agree on the algorithm parameters ''p'' and ''g''.
# The parties generate their private keys, named ''a'', ''b'', and ''c''.
# Alice computes {{math|{{var|g<sup>a</sup>}} mod {{var|p}}}} and sends it to Bob.
# Bob computes {{math|1=({{var|g<sup>a</sup>}})<sup>{{var|b}}</sup> mod {{var|p}} = {{var|g<sup>ab</sup>}} mod {{var|p}}}} and sends it to Carol.
# Carol computes {{math|1=({{var|g<sup>ab</sup>}})<sup>{{var|c}}</sup> mod {{var|p}} = {{var|g<sup>abc</sup>}} mod {{var|p}}}} and uses it as her secret.
# Bob computes {{math|g<sup>b</sup> mod {{var|p}}}} and sends it to Carol.
# Carol computes {{math|1=({{var|g<sup>b</sup>}})<sup>{{var|c}}</sup> mod {{var|p}} = {{var|g<sup>bc</sup>}} mod {{var|p}}}} and sends it to Alice.
# Alice computes {{math|1=({{var|g<sup>bc</sup>}})<sup>{{var|a}}</sup> mod {{var|p}} = {{var|g<sup>bca</sup>}} mod {{var|p}} = {{var|g<sup>abc</sup>}} mod {{var|p}}}} and uses it as her secret.
# Carol computes {{math|{{var|g<sup>c</sup>}} mod {{var|p}}}} and sends it to Alice.
# Alice computes {{math|1=({{var|g<sup>c</sup>}})<sup>{{var|a}}</sup> mod {{var|p}} = {{var|g<sup>ca</sup>}} mod {{var|p}}}} and sends it to Bob.
# Bob computes {{math|1=({{var|g<sup>ca</sup>}})<sup>{{var|b}}</sup> mod {{var|p}} = {{var|g<sup>cab</sup>}} mod {{var|p}} = {{var|g<sup>abc</sup>}} mod {{var|p}}}} and uses it as his secret.

An eavesdropper has been able to see {{math|1={{var|g<sup>a</sup>}} mod {{var|p}}}}, {{math|1={{var|g<sup>b</sup>}} mod {{var|p}}}}, {{math|1={{var|g<sup>c</sup>}} mod {{var|p}}}}, {{math|1={{var|g<sup>ab</sup>}} mod {{var|p}}}}, {{math|1={{var|g<sup>ac</sup>}} mod {{var|p}}}}, and {{math|1={{var|g<sup>bc</sup>}} mod {{var|p}}}}, but cannot use any combination of these to efficiently reproduce {{math|1={{var|g<sup>abc</sup>}} mod {{var|p}}}}.

To extend this mechanism to larger groups, two basic principles must be followed:
* Starting with an "empty" key consisting only of ''g'', the secret is made by raising the current value to every participant's private exponent once, in any order (the first such exponentiation yields the participant's own public key).
* Any intermediate value (having up to ''N''&minus;1 exponents applied, where ''N'' is the number of participants in the group) may be revealed publicly, but the final value (having had all ''N'' exponents applied) constitutes the shared secret and hence must never be revealed publicly. Thus, each user must obtain their copy of the secret by applying their own private key last (otherwise there would be no way for the last contributor to communicate the final key to its recipient, as that last contributor would have turned the key into the very secret the group wished to protect).

These principles leave open various options for choosing in which order participants contribute to keys. The simplest and most obvious solution is to arrange the ''N'' participants in a circle and have ''N'' keys rotate around the circle, until eventually every key has been contributed to by all ''N'' participants (ending with its owner) and each participant has contributed to ''N'' keys (ending with their own). However, this requires that every participant perform ''N'' modular exponentiations.

By choosing a more desirable order, and relying on the fact that keys can be duplicated, it is possible to reduce the number of modular exponentiations performed by each participant to {{math|log<sub>2</sub>(''N'') + 1}} using a [[Divide and conquer algorithms|divide-and-conquer-style]] approach, given here for eight participants:
# Participants A, B, C, and D each perform one exponentiation, yielding {{math|1={{var|g<sup>abcd</sup>}}}}; this value is sent to E, F, G, and H. In return, participants A, B, C, and D receive {{math|1={{var|g<sup>efgh</sup>}}}}.
# Participants A and B each perform one exponentiation, yielding {{math|1={{var|g<sup>efghab</sup>}}}}, which they send to C and D, while C and D do the same, yielding {{math|1={{var|g<sup>efghcd</sup>}}}}, which they send to A and B.
# Participant A performs an exponentiation, yielding {{math|1={{var|g<sup>efghcda</sup>}}}}, which it sends to B; similarly, B sends {{math|1={{var|g<sup>efghcdb</sup>}}}} to A. C and D do similarly.
# Participant A performs one final exponentiation, yielding the secret {{math|1={{var|g<sup>efghcdba</sup>}}}} = {{math|1={{var|g<sup>abcdefgh</sup>}}}}, while B does the same to get {{math|1={{var|g<sup>efghcdab</sup>}}}} = {{math|1={{var|g<sup>abcdefgh</sup>}}}}; again, C and D do similarly.
# Participants E through H simultaneously perform the same operations using {{math|1={{var|g<sup>abcd</sup>}}}} as their starting point.

Once this operation has been completed all participants will possess the secret {{math|1={{var|g<sup>abcdefgh</sup>}}}}, but each participant will have performed only four modular exponentiations, rather than the eight implied by a simple circular arrangement.

== Security and practical considerations ==
The protocol is considered secure against eavesdroppers if ''G'' and ''g'' are chosen properly. In particular, the order of the group G must be large, particularly if the same group is used for large amounts of traffic. The eavesdropper has to solve the [[Diffie–Hellman problem]] to obtain ''g''<sup>''ab''</sup>. This is currently considered difficult for groups whose order is large enough. An efficient algorithm to solve the [[discrete logarithm problem]] would make it easy to compute ''a'' or ''b'' and solve the Diffie–Hellman problem, making this and many other public key cryptosystems insecure. Fields of small characteristic may be less secure.<ref>{{cite conference | first1=Razvan | last1=Barbulescu | first2=Pierrick | last2=Gaudry | first3=Antoine | last3=Joux | first4=Emmanuel | last4=Thomé | title=A Heuristic Quasi-Polynomial Algorithm for Discrete Logarithm in Finite Fields of Small Characteristic | series=Lecture Notes in Computer Science | book-title=Advances in Cryptology – EUROCRYPT 2014 | conference=Proceedings 33rd Annual International Conference on the Theory and Applications of Cryptographic Techniques | location=Copenhagen, Denmark | volume=8441 |year=2014 | pages=1–16 | doi=10.1007/978-3-642-55220-5_1 | isbn=978-3-642-55220-5 | url=http://hal.inria.fr/docs/00/90/90/87/PDF/article.pdf |archive-url=https://web.archive.org/web/20200322030320/https://hal.inria.fr/docs/00/90/90/87/PDF/article.pdf |archive-date=2020-03-22 |url-status=live }}</ref>

The [[Order (group theory)|order]] of ''G'' should have a large prime factor to prevent use of the [[Pohlig–Hellman algorithm]] to obtain ''a'' or ''b''. For this reason, a [[Sophie Germain prime]] ''q'' is sometimes used to calculate {{nowrap|1=''p'' = 2''q'' + 1}}, called a [[safe prime]], since the order of ''G'' is then only divisible by 2 and ''q''. Sometimes ''g'' is chosen to generate the order ''q'' subgroup of ''G'', rather than ''G'', so that the [[Legendre symbol]] of ''g<sup>a</sup>'' never reveals the low order bit of ''a''. A protocol using such a choice is for example [[Internet Key Exchange|IKEv2]].<ref>{{cite news |title=RFC 4306 Internet Key Exchange (IKEv2) Protocol |publisher=Internet Engineeringrg/web/20150107073645/http://www.ietf.org/rfc/rfc4306.txt }}</ref>

The generator ''g'' is often a small integer such as 2. Because of the [[random self-reducibility]] of the discrete logarithm problem a small ''g'' is equally secure as any other generator of the same group.

If Alice and Bob use [[random number generator]]s whose outputs are not completely random and can be predicted to some extent, then it is much easier to eavesdrop.

In the original description, the Diffie–Hellman exchange by itself does not provide [[authentication]] of the communicating parties and can be vulnerable to a [[man-in-the-middle attack]].
Mallory (an active attacker executing the man-in-the-middle attack) may establish two distinct key exchanges, one with Alice and the other with Bob, effectively masquerading as Alice to Bob, and vice versa, allowing her to decrypt, then re-encrypt, the messages passed between them. Note that Mallory must be in the middle from the beginning and continuing to be so, actively decrypting and re-encrypting messages every time Alice and Bob communicate. If she arrives after the keys have been generated and the encrypted conversation between Alice and Bob has already begun, the attack cannot succeed. If she is ever absent, her previous presence is then revealed to Alice and Bob. They will know that all of their private conversations had been intercepted and decoded by someone in the channel. In most cases it will not help them get Mallory's private key, even if she used the same key for both exchanges.

A method to authenticate the communicating parties to each other is generally needed to prevent this type of attack. Variants of Diffie–Hellman, such as [[Station-to-Station protocol|STS protocol]], may be used instead to avoid these types of attacks.

=== Denial-of-service attack ===

A [[Common Vulnerabilities and Exposures|CVE]] released in 2021 (''[https://nvd.nist.gov/vuln/detail/CVE-2002-20001 CVE-2002-20001]'') disclosed a [[denial-of-service attack]] (DoS) against the protocol variants use ephemeral keys, called D(HE)at attack.<ref name=dheatattack>{{cite journal|last1=Pfeiffer|first1=Szilárd|last2=Tihanyi|first2=Norbert|date=25 December 2023|title=D(HE)at: A Practical Denial-of-Service Attack on the Finite Field Diffie-Hellman Key Exchange|journal=[[IEEE Access]]|volume=12|pages=957–980|doi=10.1109/ACCESS.2023.3347422|doi-access=free}}</ref> The attack exploits that the Diffie–Hellman key exchange allows attackers to send arbitrary numbers that are actually not public keys, triggering expensive modular exponentiation calculations on the victim's side. Another CVEs released  disclosed that the Diffie–Hellman key exchange implementations may use long private exponents  (''[https://nvd.nist.gov/vuln/detail/CVE-2022-40735 CVE-2022-40735]'') that arguably make modular exponentiation calculations unnecessarily expensive<ref name="Oorschot Wiener 1996">{{cite book|last1=van Oorschot|first1=P.C.|last2=Wiener|first2=M.J.|date=1996|title=Advances in Cryptology — EUROCRYPT '96|chapter=On Diffie-Hellman Key Agreement with Short Exponents|series=Lecture Notes in Computer Science |volume=1070 |chapter-url=https://link.springer.com/chapter/10.1007/3-540-68339-9_29|url-status=live|publication-date=2001|publisher=Springer, Berlin, Heidelberg|pages=332–343|doi=10.1007/3-540-68339-9_29|isbn=978-3-540-61186-8 |archive-url=https://web.archive.org/web/20230219191210/https://link.springer.com/chapter/10.1007/3-540-68339-9_29|archive-date=2023-02-19}}</ref> or may unnecessary check peer's public key (''[https://nvd.nist.gov/vuln/detail/CVE-2024-41996 CVE-2024-41996]'') has similar resource requirement as key calculation using a long exponent.<ref>{{cite web |last1=Elaine |first1=Barker |last2=Lily |first2=Chen |last3=Allen |first3=Roginsky |last4=Apostol |first4=Vassilev |last5=Richard |first5=Davis |title=Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography |url=https://csrc.nist.gov/pubs/sp/800/56/a/r3/final |publisher=National Institute of Standards and Technology|doi=10.6028/NIST.SP.800-56Ar3|doi-access=free|publication-date=2018}}</ref> An attacker can exploit both vulnerabilities together.

=== Practical attacks on Internet traffic ===
The [[General number field sieve|number field sieve]] algorithm, which is generally the most effective in solving the [[discrete logarithm problem]], consists of four computational steps. The first three steps only depend on the order of the group G, not on the specific number whose finite log is desired.<ref>Whitfield Diffie, Paul C. Van Oorschot, and Michael J. Wiener "Authentication and Authenticated Key Exchanges", in Designs, Codes and Cryptography, 2, 107–125 (1992), Section 5.2, available as Appendix B to {{US patent|5724425}}</ref> It turns out that much Internet traffic uses one of a handful of groups that are of order 1024&nbsp;bits or less.<ref name=imperfectfs/> By [[precomputing]] the first three steps of the number field sieve for the most common groups, an attacker need only carry out the last step, which is much less computationally expensive than the first three steps, to obtain a specific logarithm. The [[Logjam (computer security)|Logjam]] attack used this vulnerability to compromise a variety of Internet services that allowed the use of groups whose order was a 512-bit prime number, so called [[export of cryptography|export grade]]. The authors needed several thousand CPU cores for a week to precompute data for a single 512-bit prime. Once that was done, individual logarithms could be solved in about a minute using two 18-core Intel Xeon CPUs.<ref name=imperfectfs/>

As estimated by the authors behind the Logjam attack, the much more difficult precomputation needed to solve the discrete log problem for a 1024-bit prime would cost on the order of $100 million, well within the budget of a large national [[intelligence agency]] such as the U.S. [[National Security Agency]] (NSA). The Logjam authors speculate that precomputation against widely reused 1024-bit DH primes is behind claims in [[2010s global surveillance disclosures|leaked NSA documents]] that NSA is able to break much of current cryptography.<ref name=imperfectfs/>

To avoid these vulnerabilities, the Logjam authors recommend use of [[elliptic curve cryptography]], for which no similar attack is known. Failing that, they recommend that the order, ''p'', of the Diffie–Hellman group should be at least 2048&nbsp;bits. They estimate that the pre-computation required for a 2048-bit prime is 10<sup>9</sup> times more difficult than for 1024-bit primes.<ref name="imperfectfs">{{cite web|url=https://weakdh.org/imperfect-forward-secrecy-ccs15.pdf |archive-url=https://web.archive.org/web/20150906213656/https://weakdh.org/imperfect-forward-secrecy-ccs15.pdf |archive-date=2015-09-06 |url-status=live|title=Imperfect Forward Secrecy: How Diffie–Hellman Fails in Practice|last1=Adrian|first1=David|last2=Bhargavan|first2=Karthikeyan|date=October 2015|last3=Durumeric|first3=Zakir|last4=Gaudry|first4=Pierrick|last5=Green|first5=Matthew|last6=Halderman|first6=J. Alex|last7=Heninger|first7=Nadia|last8=Springall|first8=Drew|last9=Thomé|first9=Emmanuel|display-authors=1|last10=Valenta|first10=Luke|last11=VanderSloot|first11=Benjamin|last12=Wustrow|first12=Eric|last13=Zanella-Béguelin|first13=Santiago|last14=Zimmermann|first14=Paul}}</ref>

=== Security against quantum computers ===
[[Quantum computing|Quantum computers]] can break public-key cryptographic schemes, such as RSA, finite-field DH and elliptic-curve DH key-exchange protocols, using [[Shor's algorithm]] for solving the [[Integer factorization|factoring problem]], the [[Discrete logarithm|discrete logarithm problem]], and the period-finding problem. A [[Post-Quantum Extended Diffie–Hellman|post-quantum variant of Diffie-Hellman algorithm]] was proposed in 2023, and relies on a combination of the quantum-resistant CRYSTALS-Kyber protocol, as well as the old elliptic curve [[X25519]] protocol. A quantum Diffie-Hellman key-exchange protocol that relies on a [[Quantum cryptography|quantum one-way function]], and its security relies  on  fundamental principles of quantum mechanics has also been proposed in the literature.<ref>{{Cite journal |last=Nikolopoulos |first=Georgios M. |date=2025-01-16 |title=Quantum Diffie–Hellman key exchange |url=https://pubs.aip.org/aip/apq/article/2/1/016107/3331640/Quantum-Diffie-Hellman-key-exchange |journal=APL Quantum |volume=2 |issue=1 |pages=016107 |doi=10.1063/5.0242473 |issn=2835-0103|arxiv=2501.09568 }}</ref>

== Other uses ==

=== Encryption ===
Public key encryption schemes based on the Diffie–Hellman key exchange have been proposed. The first such scheme is the [[ElGamal encryption]]. A more modern variant is the [[Integrated Encryption Scheme]].

=== Forward secrecy ===
Protocols that achieve [[forward secrecy]] generate new key pairs for each [[session (computer science)|session]] and discard them at the end of the session. The Diffie–Hellman key exchange is a frequent choice for such protocols, because of its fast key generation.

=== Password-authenticated key agreement ===
When Alice and Bob share a password, they may use a [[password-authenticated key agreement]] (PK) form of Diffie–Hellman to prevent man-in-the-middle attacks. One simple scheme is to compare the [[Cryptographic hash function|hash]] of '''s''' concatenated with the password calculated independently on both ends of channel. A feature of these schemes is that an attacker can only test one specific password on each iteration with the other party, and so the system provides good security with relatively weak passwords. This approach is described in [[ITU-T]] Recommendation [[X.1035]], which is used by the [[G.hn]] home networking standard.

An example of such a protocol is the [[Secure Remote Password protocol]].

=== Public key ===
It is also possible to use Diffie–Hellman as part of a [[public key infrastructure]], allowing Bob to encrypt a message so that only Alice will be able to decrypt it, with no prior communication between them other than Bob having trusted knowledge of Alice's public key. Alice's public key is <math>(g^a \bmod{p}, g, p)</math>. To send her a message, Bob chooses a random ''b'' and then sends Alice <math>g^b \bmod p</math> (unencrypted) together with the message encrypted with symmetric key <math>(g^a)^b \bmod{p}</math>. Only Alice can determine the symmetric key and hence decrypt the message because only she has ''a'' (the private key). A pre-shared public key also prevents man-in-the-middle attacks.

In practice, Diffie–Hellman is not used in this way, with [[RSA (cryptosystem)|RSA]] being the dominant public key algorithm. This is largely for historical and commercial reasons,{{citation needed|date=November 2015}} namely that [[RSA (security firm)|RSA Security]] created a certificate authority for key signing that became [[Verisign]]. Diffie–Hellman, as elaborated above, cannot directly be used to sign certificates. However, the [[ElGamal signature scheme|ElGamal]] and [[Digital Signature Algorithm|DSA]] signature algorithms are mathematically related to it, as well as [[MQV]], [[Station-to-Station protocol|STS]] and the [[Internet Key Exchange|IKE]] component of the [[IPsec]] protocol suite for securing [[Internet Protocol]] communications.

== See also ==
* [[Elliptic-curve Diffie–Hellman]] key exchange
* [[Supersingular isogeny key exchange]]
* [[Forward secrecy]]
* [[Diffie–Hellman problem]]
* [[Modular exponentiation]]
* [[Denial-of-service attack]]
* [[Post-Quantum Extended Diffie–Hellman]]

== Notes ==
{{reflist|group="nb"}}

== References ==
{{reflist}}

=== General references ===
* {{cite book | last1=Gollman | first1=Dieter | title=Computer Security | year=2011 | edition=2nd | publisher=John Wiley & Sons, Ltd. | location=West Sussex, England | isbn=978-0470741153 }}
* {{cite tech report | last1=Williamson | first1=Malcolm J. | title=Non-secret encryption using a finite field | institution=Communications Electronics Security Group | date=January 21, 1974 | url=https://www.gchq.gov.uk/sites/default/files/document_files/nonsecret_encryption_finite_field_0.pdf |archive-url=https://web.archive.org/web/20170323052715/https://www.gchq.gov.uk/sites/default/files/document_files/nonsecret_encryption_finite_field_0.pdf |archive-date=2017-03-23 |url-status=live | access-date=2017-03-22 }}
* {{cite tech report | last1=Williamson | first1=Malcolm J. | title=Thoughts on Cheaper Non-Secret Encryption | institution=Communications Electronics Security Group | date=August 10, 1976 | url=http://www.fi.muni.cz/usr/matyas/lecture/paper3.pdf |archive-url=https://web.archive.org/web/20040719085349/http://www.fi.muni.cz/usr/matyas/lecture/paper3.pdf |archive-date=2004-07-19 |url-status=live | access-date=2015-08-25 }}
* [https://web.archive.org/web/20130404174201/https://cryptocellar.web.cern.ch/cryptocellar/cesg/ellis.pdf The History of Non-Secret Encryption] [[James H. Ellis|JH Ellis]] 1987 (28K PDF file) ([https://web.archive.org/web/20040808040209/http://jya.com/ellisdoc.htm HTML version])
* [http://cr.yp.to/bib/1988/diffie.pdf The First Ten Years of Public-Key Cryptography] Whitfield Diffie, Proceedings of the IEEE, vol. 76, no. 5, May 1988, pp: 560–577 (1.9MB PDF file)
* [[Alfred Menezes|Menezes, Alfred]]; [[Paul van Oorschot|van Oorschot, Paul]]; [[Scott Vanstone|Vanstone, Scott]] (1997). ''[[Handbook of Applied Cryptography]]'' Boca Raton, Florida: CRC Press. {{ISBN|0-8493-8523-7}}. ([http://www.cacr.math.uwaterloo.ca/hac/ Available online])
* [[Simon Singh|Singh, Simon]] (1999) ''[[The Code Book: the evolution of secrecy from Mary Queen of Scots to quantum cryptography]]'' New York: Doubleday {{ISBN|0-385-49531-5}}
* [https://dx.doi.org/10.1109/MCOM.2002.1006971 An Overview of Public Key Cryptography] Martin E. Hellman, IEEE Communications Magazine, May 2002, pp.&nbsp;42–49. (123kB PDF file)

== External links ==
{{External links|date=March 2016}}
* [https://conservancy.umn.edu/handle/11299/107353 Oral history interview with Martin Hellman], [[Charles Babbage Institute]], University of Minnesota. Leading cryptography scholar Martin Hellman discusses the circumstances and fundamental insights of his invention of public key cryptography with collaborators Whitfield Diffie and Ralph Merkle at [[Stanford University]] in the mid-1970s.
* {{IETF RFC|2631|link=no}} – ''Diffie–Hellman Key Agreement Method''. E. Rescorla. June 1999.
* {{IETF RFC|3526|link=no}} – ''More Modular Exponential (MODP) Diffie–Hellman groups for Internet Key Exchange (IKE)''. T. Kivinen, M. Kojo, SSH Communications Security. May 2003.
* [https://web.archive.org/web/20040903080553/http://csrc.nist.gov/CryptoToolkit/kms/summary-x9-42.pdf Summary of ANSI X9.42: Agreement of Symmetric Keys Using Discrete Logarithm Cryptography] (64K PDF file) ([https://web.archive.org/web/20040816210145/http://www.rsasecurity.com/rsalabs/node.asp?id=2306 Description of ANSI 9 Standards])
* [https://www.youtube.com/watch?v=zTGqP0nxX08 Talk by Martin Hellman in 2007, YouTube video]
* [https://www.networkworld.com/article/948802/crypto-dream-team-diffie-hellman-win-nobel-prize-of-computing.html Crypto dream team Diffie & Hellman wins $1M 2015 Turing Award (a.k.a. "Nobel Prize of Computing")]
* [http://neilrieck.net/dh_demo.html A Diffie–Hellman demo written in Python3]{{snd}} This demo properly supports very-large key data and enforces the use of prime numbers where required.

{{Cryptography navbox | public-key}}

{{DEFAULTSORT:Diffie-Hellman key exchange}}
[[Category:Key-agreement protocols]]
[[Category:Public-key cryptography]]