367

Diffie-Hellman is a way of generating a shared secret between two people in such a way that the secret can't be seen by observing the communication. That's an important distinction: You're not sharing information during the key exchange, you're creating a key together. This is particularly useful because you can use this technique to create an encryption ...


157

Diffie-Hellman is a key exchange protocol but does nothing about authentication. There is a high-level, conceptual way to see that. In the world of computer networks and cryptography, all you can see, really, are zeros and ones sent over some wires. Entities can be distinguished from each other only by the zeros and ones that they can or cannot send. Thus, ...


147

The other answers do an excellent job explaining the maths behind the key exchange. If you'd like a more pictorial representation, nothing beats the excellent paint analogy shown on the Diffie–Hellman key exchange Wikipedia entry: Image is in the public domain


138

The situation can be confused, so let's set things right. RSA is two algorithms, one for asymmetric encryption, and one for digital signatures. These are two distinct beast; although they share the same core mathematical operation and format for keys, they do different things in different ways. Diffie-Hellman is a key exchange algorithm, which is yet ...


69

If the attacker is only passively listening to the connection then Diffie Hellman Key Exchange can be done to create a common key known only to the communication peers. But, if the attacker can not only listen to the connection but also actively modify the transferred data, then the attacker might mount a man-in-the-middle attack and claim to be the ...


58

Tom has provided a good explanation as to why Diffie-Hellman cannot be safe against man-in-the-middling. Now this answers the OP's original question but probably leaves some readers with the (reasonable) follow-up question: Why don't we just use public-key (asymmetric) cryptography to ensure the confidentiality of our messages, and drop D-H altogether? There ...


56

If the attacker is able to passively capture data and later gets access to the private key of the certificates (i.e. stealing, heartbleed attack or law enforcement), then the attacker could decode all previously captured data if the encryption key is only derived from the certificate itself. DH key exchange makes it possible to create a key independent from ...


37

The best practice is: The basic idea. Create an API key (a 128-bit symmetric key) for each separate user account. This key needs to be securely stored on the server, and also securely stored on the user's client. For each request made by the client, add an extra request parameter that has a "signature" on the entire request. The "signature" should be ...


32

If you want a simpler plain English explanation of DH that can be readily understood by even non-technical people, there is the double locked box analogy. Alice puts a secret in a box and locks it with a padlock that she has the only key to open. She then ships the box to Bob. Bob receives the box, puts a second padlock that only he has the key to on it, ...


31

A lot of the answers already provided are overlooking the interception capability of the ISP or NSA. Take a look at Room 641A in the AT&T datacenter. There are an estimated 10 to 20 such facilities that have been installed throughout the United States. Also take a look at the One Wilshire building where 260 ISP's connections converge into one building. ...


28

The problem with a one time pad, is that is must be equal in length (or longer) than the data being encrypted , and must never, ever, be reused. Just as you indicate, how would they send the key?, the OTP must then be sent in a secure way... however that is the problem that is usually left to the user and is generally why OTP is useless. If you have the ...


28

The host key is used to sign the Diffie-Hellman parameters. It is used during the key exchange; RSA is a signature algorithm as well as an encryption algorithm. From what I can tell, the client key (in authorized_keys) is not used in key exchange at all; it's only used after key exchange to sign a particular message and prove the client has the private key (...


27

Asymmetric Cryptography There are two different parts to creating a TLS session. There is the asymmetric cryptography, portion which is an exchange of public keys between two points. Which is what you saw in your Alice and Bob example. This only allows the exchange of asymmetric keys for asymmetric encryption/decryption. This is the ECDHE portion. The ...


26

The key exchange problem A secure connection requires the exchange of keys. But the keys themselves would need to be transfered on a secure connection. There are two possible solution: exchange the key by physically meeting and sharing the keys. Somehow established a shared secret on a public unsecure channel. This is easier said than done, and the first ...


26

I think I can help resolve your concerns. So what are we trying to protect? We're trying to protect ourselves from an attacker breaking into user accounts via our web services. Specifically, how might we protect ourselves from an attacker sufficiently motivated to reverse-engineer our mobile app in the wild? You can't. It's that simple. Trying to do ...


24

Yep. Open wireless networks are entirely unencrypted; anyone can see all the data you send (even if they aren't connected to the network).


19

DH ephemeral key exchange provides perfect forward secrecy, which RSA alone does not. This means that even if the long-term key is leaked at a later date, the session keys for individual connections are not compromised, even if the full data stream is captured.


19

How would they pass they key? This gets to the root of where OTPs came from, and indeed how they got that name. This is for correspondence during wartime with ships or other similar agents[*]. When the ship leaves port, they head out with a pad of random data. When they receive an encrypted communication over the radio, they decode it using the indicated ...


19

The behaviour of OpenSSL, as a library, is documented in the man page for SSL_CTX_set_tmp_dh_callback(). Basically, the library itself contains no pre-generated DH parameters and will refuse to do any "DHE" handshake until such parameters have been provided. The caller (the application which uses OpenSSL for running an SSL server) may provide DH parameters ...


19

From what you describe, what they do is that they tunnel data in some SSL (this is reasonable) but add an extra encryption layer in Javascript (this is not reasonable). The whole reasoning is faulty. Indeed, either the SSL ensures security of transmissions, in which case the extra layer is simply useless; or the SSL does not ensure security of transmission, ...


18

In order to protect from a man-in-the-middle attack, at least one of the endpoints of the communication needs to have some prior knowledge about the other endpoint. It's usually up to the client to verify that it's talking to the right server, because servers tend to allow potentially any client to connect to them. The general term for the kind of ...


17

There are many steps needed to understand the reasons and I will try to guide you through each. 1) Use encryption correctly... With RSA algorithm, Alice and Bob can just share their public keys (public_a, public_b) and keep their private keys (private_a, private_b). Alice can just send Bob the messages which are encrypted by private_a, and Bob can ...


13

SSL relies on public key cryptography. A server that participates in SSL has a keypair, which has public and private components. Imagine you have a special lockbox with two keys: one key can lock the box, and another can unlock the box. If your friend wants to send you a secret message, he only needs the locking key, and you can keep the unlocking key ...


13

To get Perfect Forward Secrecy, you have to use ephemeral keys. With static Diffie-Hellman (elliptic curve or not, that's not the issue), Alice and Bob both own a DH key pair: Alice's private key is a, public key is aG (elliptic curve notation, G is the conventional "base point" for the curve); Bob's private key is b, public key is bG. When Alice and Bob ...


12

First, my apologies for the math, and for overly simplifying the math! The difference between DHE and ECDH in two bullet points: DHE uses modular arithmetic to compute the shared secret. ECDH is like DHE but in addition, uses algebraic curves to generate keys (An elliptic curve is a type of algebraic curve). The overall method in both cases is still ...


12

Not really "Internet", but the one-time pad is documented to have been used for the Red Phone (a westernly-biased name; I don't know how they called it in Moscow). The pads were exchanged on magnetic tapes, sent by planes on a weekly basis. It is possible that the current system still uses a similar encryption method. This makes sense: though the one-time ...


12

Your description is a bit confused and appears to be wrong. In particular, we see Alice computing here Diffie-Hellman half gKA and then proceed to send... her Diffie-Hellman secret KA to Bob, which is not at all what she should do. Plain Diffie-Hellman works the following way: Alice generates (randomly) her secret KA and computes gKA. Bob generates (...


10

Transport Layer Security (which is what Secure Sockets Layer is now called) involves methods of securely exchanging cryptographic keys over an insecure communications channel (like the internet). Yes, this means that the ISP can see the key exchange information as it passes back and forth, and yet still has insufficient information to read the message ...


10

Right now, it seems that none of the existing major browsers supports TLS-PSK, and neither to they support TLS-SRP. In your case, both are applicable, but SRP is "stronger" in that it tolerates much better a low-entropy shared secret (say, a password). There has been some initial effort at making Chrome SRP-aware; I don't know how far it went. Since ...


Only top voted, non community-wiki answers of a minimum length are eligible