security//cryptography//key exchange

A key exchange is a protocol by which two parties derive the same secret key over a channel anyone can watch, without the secret ever crossing it. Every encrypted connection on the internet starts with one (HTTPS, SSH, WireGuard), because bulk data is encrypted with fast symmetric ciphers and both ends need the same key for them.

A key exchange is a protocol by which two parties derive the same secret key over a channel anyone can watch, without the secret ever crossing it. Every encrypted connection on the internet starts with one (HTTPS, SSH, WireGuard), because bulk data is encrypted with fast symmetric ciphers and both ends need the same key for them.

The standard construction is Diffie-Hellman. Each side picks a private number and publishes a public value computed from it; each then combines its own private number with the other's public value, and the mathematics guarantees both get the same result, while an observer who sees only the two public values cannot compute it. Modern systems do this on an elliptic curve (ECDH), most often Curve25519, where the exchange is called X25519: a private key is 32 random bytes and a public key is 32 bytes too.

On its own the exchange is anonymous: it proves both sides now share a secret, not who the other side is. An attacker in the middle could run one exchange with each party. Real protocols bind the exchange to identity, by signing it with a long-term key (the host key in SSH) or by mixing long-term static keys into it (the Noise handshake of WireGuard).

Using fresh private values for every session gives forward secrecy: stealing a long-term key later does not decrypt recorded past sessions, because their session keys came from values that were thrown away.

The output is not used directly. It goes through a key-derivation function that turns it into separate keys for each direction and purpose, along with a session identifier that later signatures can cover.

It belongs to public-key cryptography: the same asymmetry that makes signatures possible makes the shared secret computable by the two ends and by nobody else.