AsymmetricAcceptable
Diffie-Hellman key exchange
Key agreement
How it works
Two parties each pick a secret value, exchange public values derived from it, and both compute the same shared secret that an eavesdropper cannot feasibly derive. Security rests on the discrete logarithm problem. Diffie-Hellman agrees on a key; it does not encrypt data or prove identity on its own.
Sizes: Finite-field groups of 2048 bits or more
Status: Use ephemeral DH with 2048-bit or larger standard groups; ECDH is usually preferred.
Strengths
- Ephemeral DH (DHE) gives perfect forward secrecy.
- Two parties can agree on a secret over a fully public channel.
Weaknesses and known attacks
- Unauthenticated DH is open to man-in-the-middle attacks; the exchange must be signed or otherwise authenticated.
- Logjam (2015) downgraded TLS to weak 512-bit 'export' groups, and widely shared groups made precomputation attractive.
- Static DH keys provide no forward secrecy; TLS 1.3 removed static DH.
- Vulnerable to Shor's algorithm on a large quantum computer.
Use it for
- Session key agreement in TLS (DHE), IPsec/IKE and SSH
Don't use it for
- Encrypting data directly
- Groups smaller than 2048 bits
- Unauthenticated exchanges
Exam tip
Diffie-Hellman is key EXCHANGE (agreement), not encryption and not authentication. Its classic weakness is man-in-the-middle when the exchange is not authenticated.