What is Key Exchange?
A cryptographic protocol that allows two parties to establish a shared secret key over an insecure channel. This shared key can then be used for symmetric encryption, enabling secure communication without prior contact.
Also known as: Key Agreement, Key Negotiation
Key exchange solves a fundamental problem: how can two people who've never met establish a shared secret while communicating over a channel that attackers can observe?
The Classic Problem
Alice and Bob want to communicate securely. They need a shared key for symmetric encryption. But how do they agree on a key without Eve (the eavesdropper) learning it too?
Diffie-Hellman: The Breakthrough
In 1976, Diffie and Hellman solved this with mathematical magic:
- Alice and Bob agree on public parameters (g, p)
- Alice picks secret 'a', computes A = g^a mod p, sends A
- Bob picks secret 'b', computes B = g^b mod p, sends B
- Alice computes s = B^a mod p
- Bob computes s = A^b mod p
- Both arrive at the same shared secret 's'!
Eve sees A and B but can't compute 's' without 'a' or 'b'.
Modern Key Exchange Protocols
ECDH (Elliptic Curve Diffie-Hellman)
- Same concept, elliptic curve math
- Smaller keys, faster operations
- Most common in modern TLS
X25519
- ECDH using Curve25519
- Designed for security and performance
- Used by Signal, WireGuard, modern TLS
Kyber (Post-Quantum)
- Lattice-based key exchange
- Resistant to quantum computers
- Being standardized by NIST
Key Exchange in Practice
TLS/HTTPS Handshake
- Client sends supported algorithms
- Server picks algorithm, sends certificate
- Key exchange establishes shared secret
- Symmetric encryption begins
Signal Protocol
- Initial key exchange using X3DH
- Ongoing key rotation (Double Ratchet)
- Forward secrecy for every message
Why Forward Secrecy Matters
Ephemeral key exchange (new keys each session) means:
- Past communications stay secure even if long-term keys leak
- No single point of compromise
- "Harvest now, decrypt later" attacks fail
Related Terms
Encryption
The process of converting information into a code to prevent unauthorized access. Encryption transforms readable data (plaintext) into an unreadable format (ciphertext) using a cryptographic algorithm and key. Only those with the correct key can decrypt and read the original data.
Perfect Forward Secrecy
A feature of key-agreement protocols that ensures session keys cannot be compromised even if the server's long-term private key is compromised. Each session uses unique keys, so past communications remain secure even if future keys are exposed.
TLS
Transport Layer Security is a cryptographic protocol designed to provide secure communication over a computer network. TLS encrypts the connection between your browser and web servers, ensuring privacy and data integrity. It's the technology behind HTTPS.
Have more questions?
Use our guided flow to get the right next privacy step for Key Exchange.
Open Guided Flow