Skip to main content
protocols.pageprotocols.page
tls

Key Exchange

Key exchange is the process of establishing a shared secret between client and server over an insecure channel. TLS uses ephemeral Diffie-Hellman (DHE/ECDHE) – both parties contribute randomness, and eavesdroppers cannot derive the shared key. ECDHE with Curve25519 or P-256 is the modern standard. Static RSA key exchange has no forward secrecy.

Definition

Key exchange enables two parties to agree on a symmetric encryption key without transmitting it directly. In TLS, the client and server each generate ephemeral key pairs, exchange public values, and independently compute the same shared secret using elliptic curve mathematics (ECDHE) or modular exponentiation (DHE). An eavesdropper who records the public values cannot compute the shared secret without solving the discrete logarithm problem. Static RSA key exchange (deprecated in TLS 1.3) encrypted the pre-master secret with the server's long-term RSA key – if that key is later compromised, all past sessions are decryptable (no forward secrecy). ECDHE avoids this because ephemeral keys are discarded after each session. X25519 (Curve25519-based ECDHE) is preferred for performance and side-channel resistance.

Examples

  • –TLS 1.3 key_share extension carries client's ECDHE public key in ClientHello
  • –openssl speed ecdhx25519 – benchmarks X25519 key exchange performance
  • –Wireshark: Client Key Exchange message shows the ephemeral public value

Related Protocols

tls

Related Terms

Cipher Suite

A cipher suite is the combination of algorithms negotiated during a TLS handshake: key exchange (ECDHE), authentication (RSA/ECDSA), bulk encryption (AES-256-GCM), and integrity (SHA-384). TLS 1.3 simplified suites to just AEAD cipher + hash, removing key exchange from the suite name since ECDHE is mandatory.

Perfect Forward Secrecy (PFS)

Perfect Forward Secrecy guarantees that compromise of long-term keys does not decrypt past sessions. PFS requires ephemeral key exchange (DHE/ECDHE) – each session uses unique keys that are destroyed after use. If the server's private key is stolen tomorrow, previously captured traffic remains encrypted. TLS 1.3 mandates PFS.