Diffie-Hellman: Groups, Ephemeral Keys, and the Downgrade Attacks

Diffie-Hellman lets two parties who have never communicated derive a shared secret over a channel anyone can read. That result is counterintuitive enough that it is worth stating plainly: the entire exchange can be captured, and the observer still cannot compute the secret.

How it works, without the arithmetic

Both parties agree publicly on a set of parameters. Each generates a private value they keep, derives a public value from it, and sends that. Each then combines their own private value with the other's public value, and the mathematics is arranged so that both arrive at the same result.

An observer sees both public values and the parameters, and computing the shared secret from them requires solving a problem believed to be hard — the discrete logarithm problem, or its elliptic curve equivalent.

The key point for the exam: Diffie-Hellman is key agreement, not encryption. It produces a shared secret and transmits nothing confidential. What the secret is then used for — typically a symmetric cipher — is a separate step, which is why it appears alongside asymmetric encryption rather than as an alternative to it.

It authenticates nothing

The critical weakness, and the reason it is never used alone.

Because the parties have no prior knowledge of each other, neither can tell who they exchanged with. An attacker in the path runs the exchange twice — once with each party — holds two shared secrets, and relays traffic between them while reading everything. Both sides believe they have a secure channel, and they do; it just terminates at the attacker.

So Diffie-Hellman must be combined with authentication. In TLS that is the server's certificate, signing the exchange to prove the public value came from the certificate holder. In IPsec it is the pre-shared key or certificate in phase 1.

Unauthenticated Diffie-Hellman protects against passive eavesdropping and not against an active attacker, which is the same distinction as opportunistic versus strict privacy elsewhere.

Ephemeral versus static

The distinction that determines forward secrecy.

Static Diffie-Hellman reuses the same private values across sessions. The shared secret is therefore the same every time, and anyone who later obtains the long-term private key can compute it for every session they recorded.

Ephemeral Diffie-Hellman — DHE, or ECDHE with elliptic curves — generates fresh values for every session and discards them afterwards. Each session's secret exists nowhere once the session ends, so compromising the server's long-term key later reveals nothing about recorded traffic.

That property is forward secrecy, and it is the reason modern TLS uses ephemeral exchange exclusively. It is also why a network appliance holding a copy of the server's private key can no longer decrypt captured traffic, and interception must happen at a proxy instead — the arrangement under TLS proxies.

Groups and parameter strength

The security depends on the parameters. Finite-field Diffie-Hellman uses a large prime, and the named groups specify standard values at various sizes — 1024-bit groups are considered inadequate and 2048-bit is the practical minimum.

Elliptic curve Diffie-Hellman achieves comparable strength with far smaller values, so a 256-bit curve is roughly equivalent to a 3072-bit finite-field group. Smaller, faster, less data on the wire, which is why ECDHE dominates.

Two historical attacks illustrate why parameters matter. Logjam exploited servers supporting deliberately weakened export-grade parameters, letting an attacker force a downgrade to a group small enough to break — the general pattern of a strong protocol with a weak fallback that the attacker selects. Precomputation against widely shared standard primes made attacking many sessions cheaper once the one-time work was done, which is an argument for unique parameters or for elliptic curves.

The hardening conclusion: disable weak groups rather than merely preferring strong ones, and prefer ECDHE.

Post-quantum

A sufficiently capable quantum computer would break both finite-field and elliptic curve Diffie-Hellman, since both rest on problems quantum algorithms solve efficiently.

The practical concern now is harvest-now-decrypt-later: traffic captured today and stored until it can be decrypted. Forward secrecy does not help against this, because the session key is what the future attacker would derive.

The response is hybrid key exchange — combining a classical exchange with a post-quantum algorithm so the result is secure if either holds — which is already deployed in parts of the web and is the migration path being followed.

Exam angles

Know Diffie-Hellman as key agreement producing a shared secret over a public channel, not as encryption, and that it provides no authentication and so is vulnerable to an active machine-in-the-middle without a certificate or pre-shared key. Distinguish static from ephemeral, with ephemeral (DHE, ECDHE) providing forward secrecy. Know that ECDHE achieves equivalent strength with smaller keys, and that weak or shared parameters enable downgrade and precomputation attacks.