Diffie-Hellman key exchange

From Wikipedia, the free encyclopedia
Jump to: navigation, search
Example exhange using colors

Diffie-Hellman key exchange (D-H) is a cryptographic protocol that allows two parties that have no prior knowledge of each other to securely agree on a shared secret key over an insecure communications channel. Then they use this key to encrypt subsequent communications using a symmetric-key cipher.

Synonyms of Diffie-Hellman key exchange include:

  • Diffie-Hellman key agreement
  • Diffie-Hellman key establishment
  • Diffie-Hellman key negotiation
  • Exponential key exchange

The scheme was first published publicly by Whitfield Diffie and Martin Hellman in 1976, Diffie-Hellman key agreement itself is an anonymous (non-authenticated) key-agreement protocol, it provides the basis for a variety of authenticated protocols, and is used to provide perfect forward secrecy in Transport Layer Security's short-lived modes.

In the original description papers, the Diffie-Hellman exchange by itself does not provide authentication of the communicating parties and is thus susceptible to a man-in-the-middle attack. An attacking person in the middle may establish two different Diffie-Hellman key exchanges, with the two members of the party "A" and "B", appearing as "A" to "B", and vice versa, allowing the attacker to decrypt (and read or store) then re-encrypt the messages passed between them. A method to authenticate the communicating parties to each other is generally needed to prevent this type of attack.

Many cryptographic authentication solutions include a Diffie-Hellman exchange. When two parties "A" and "B" have a public key infrastructure, they may digitally sign the agreed key "G", or GA and GB, as in MQV, STS and the IKE component of the IPsec protocol suite for securing Internet Protocol communications. When "A" and "B" share a password, they may use a password-authenticated key agreement form of Diffie-Hellman.

References[change | change source]

Other pages[change | change source]

Other websites[change | change source]