Key exchange: Diffie-Hellman and establishing a shared secret

Two parties want to agree on a shared secret, communicating only over a channel where an eavesdropper can see every single message exchanged. Lesson 3 already showed one way to solve a version of this (encrypt a key with a public key), but Diffie-Hellman (DH) solves it differently — without either party ever transmitting the secret itself, encrypted or not.

A commonly used analogy: imagine two parties who each pick a secret color, and there's one shared public color known to both (and to any eavesdropper). Each person mixes their secret color with the shared public color and sends the mixture — not their secret color itself — to the other. Each person then mixes the mixture they received with their own original secret color:

Mixing colors is easy in one direction and effectively impossible to "unmix" back into the two original components — the same one-way asymmetry lesson 3 described for prime factorization. An eavesdropper sees the public color and both mixtures, but that's not enough information to reconstruct either secret color or the final shared result, the same way seeing two mixed paint colors doesn't tell you what was mixed into them.

Diffie-Hellman replaces "mixing colors" with modular exponentiation — computing a value raised to a power, then taking the remainder after dividing by a large public number. Like the paint analogy, this operation is easy to compute forward but computationally infeasible to reverse (recovering the original secret exponent from the result is the discrete logarithm problem, a genuinely hard problem for large enough numbers) — the same shape of one-way hardness assumption lesson 3's RSA relies on, just built on a different mathematical problem.

Lesson 3 showed one way to share a key: encrypt it with the recipient's public key. Diffie-Hellman offers a different, complementary property many modern systems specifically want: forward secrecy. If a long-term private key is ever compromised in the future, forward secrecy ensures that past recorded conversations still can't be decrypted, because each session generated a fresh, temporary shared secret via a fresh DH exchange — rather than a single long-term key protecting every past and future session equally. This is exactly why "Ephemeral Diffie-Hellman" (a fresh DH exchange for every new TLS connection) is a standard part of modern TLS, covered concretely in lesson 7.

Modern TLS uses a DH-family key exchange (or a variant using elliptic curves, connecting back to lesson 3's ECC mention) specifically for this forward-secrecy property, rather than relying purely on RSA key encryption — the client and server perform a DH-style exchange to agree on a session key, then switch to fast symmetric encryption (lesson 2) for the actual data, exactly matching the "brief asymmetric step, then fast symmetric encryption" pattern lesson 3 described in general terms.