Diffie-Hellman (DH)

Index

Using Diffie-Hellman (DH) for key exchange

Diffie-Hellman is one of the oldest public-key cryptosystems. It is often called a key-agreement protocol, because it allows the establishment of a common secret key, that can be used to encrypt and decrypt messages.

Generate DH public key parameters

Generate the DH public key parameters and save them to a file (this may take a while to complete depending on the key size - you need to be patient).

openssl dhparam -out dhparams.pem 2048

Here are the parameters generated in base64.

-----BEGIN DH PARAMETERS-----
MIIBCAKCAQEA/J7CXLjNaOZoL9QNkhlPI8iGjuI1hVLHKCxdLP5LhLqqPfOiKLBE
8wU8LgiAOiH7jMW4BfohuoCRG7E8xWnplt1Rn1SAiiZzdeKKY4t08fiCAmO3EUHj
sxXPwV537IbbN2d2MRxIodCla9nIx/x906foXfhpr4mi3k+dfg5lv/2HOnjST0qR
NccwjqH+k3ye03bhuB6D9pEL2prRrDxn13q4UGoh0Uwp/wcxHQk1sy6ouvaaEJYm
OKemxWVZ19EPOpIVxvgVTa0e28z7zlDP/9+xN7fCu46Irv0SWVxa2JnAogP308rk
8xAgeRJA4lRKOAgFb2dJZSNT65w19SeBqwIBAg==
-----END DH PARAMETERS-----

To view the contents of the parameters of the file, please do:

And you'll have access to the parameters created.

Generate the DH private and public keys

Using the DH public parameters that were created in the previous step, it is now necessary to create the public and private keys of both entities that need to communicate (again Alice and Bob).

So, both Alice and Bob, need to have the dhparams.pem file created in the previous step.

Now, Alice can do the following to create its private key:

Let’s look at the content of Alice private key:

This is the contents of the private key:

Now Bob, needs to do the same thing:

After this, Bob and Alice need to exchange their public keys. These need to get extracted from their private key files generated in the previous step.

So, Alice does:

And Bob, does:

Now, Alice can send alice_public.dh to Bob, and Bob can send bob_public.dh to Alice.

Finally, both Alice and Bob, can compute a common secret key that can be used to exchange encrypted information. Alice, needs to derive its key:

And Bob, can do the same:

If we compare them both, they are equal.

And you can look at the content of the files... using hexdump utility.

Here are the contents of the key:

As an alternative for the creation of keys we could use the following examples. In these examples, we create the common DH key and after that we create an SHA-256 hash of the key. This way, we end-up with a raw 256-bit key that can be used directly. This key is store on the alice_common_key.dh and bob_common_key.dh.

So Alice does:

For the case of Bob:

In this case, we end up with this key (dd7fa8bee81aa373924fcf68348fff7c8cdf4eb2078b0000ebf1f7899802c48f).

Looking at the files:

They both contain the same information:

This key can be used as secret key to cipher and decipher data, as we can see in the next section.

Encrypt and decrypt with DH

Now that we have a common key between Alice and Bob, this key can be used to do symmetric cryptography between the two parties communicating. Consider the plain.txt and cipher.txt below, two examples of files that are going to be encrypted or decrypted.

To encrypt data in Alice, we can use:

To decrypt data in the Bob side, we can do:

Another possibility is to use the raw key that we've created before. To encrypt data Alice can do the following:

Bob to decrypt data does the following:

PreviousElliptic Curve CryptographyNextDigital Signatures

Last updated