What is the difference in the purpose of DH and RSA? Aren't they both public-key encryption?

  • 1
    $\begingroup$ This other question seems nearly identical. $\endgroup$
    – B-Con
    Commented Jun 12, 2012 at 16:07
  • $\begingroup$ @B-Con: Actually, it misses the precise point I was trying to make with this post. :) Notice the word "mathematical" in the title -- that was specifically not the real goal of my question/answer here, because I already knew that they're different mathematically (they're different algorithms, after all). :P (See my comment on my answer below.) $\endgroup$
    – user541686
    Commented Jun 12, 2012 at 16:09
  • 1
    $\begingroup$ Here is a good coverage on the differences: security.stackexchange.com/questions/35471/… $\endgroup$
    – Peter Teoh
    Commented Jun 5, 2016 at 3:27

2 Answers 2


The difference is subtle.
DH is used to generate a shared secret in public for later symmetric ("private-key") encryption:


  • Creates a shared secret between two (or more) parties, for symmetric cryptography
  • Key identity: (gens1)s2 = (gens2)s1 = shared secret   (mod prime)
  • Where:

    • gen is an integer whose powers generate all integer in [1, prime)   (mod prime)
    • s1 and s2 are the individuals' "secrets", only used to generate the symmetric key

RSA is used to come up with a public/private key pair for asymmetric ("public-key") encryption:


  • Used to perform "true" public-key cryptography
  • Key identity: (me)d = m   (mod n)   (lets you recover the encrypted message)
  • Where:

    • n = prime1 × prime2    (n is publicly used for encryption)
    • φ = (prime1 - 1) × (prime2 - 1)   (Euler's totient function)
    • e is such that 1 < e < φ, and (e, φ) are coprime    (e is publicly used for encryption)
    • d × e = 1   (mod φ)    (the modular inverse d is privately used for decryption)

It just so happens that -- in practice -- RSA's results are subsequently used to generate a symmetric key.
Furthermore, it also happens that you can also modify DH to be used for public-key encryption.
But they are fundamentally different, even though both of them have "public" and "private" components.

  • $\begingroup$ Hmm, this is about the difference from the outside (i.e. the interface), i.e. the difference between key exchange and public key encryption. When asked about the fundamental difference, I would think more about the number-theoretic principles behind them (RSA: discrete root, factorization, DH/DSA/...: discrete logarithm Diffie-Hellman assumption). $\endgroup$ Commented Jun 11, 2012 at 19:26
  • 1
    $\begingroup$ @PaŭloEbermann: That's definitely a valid answer to the question -- but the issue was that I had a harder time coming up with the question than the answer haha, since wasn't looking for the mathematical difference so much as the nature of their difference. I was looking for someone to explain this^ concept, so when I found it out myself I just wrote a question for it so I could write the answer too. :) If you can think of a better way to phrase the question to match the answer then I'd love to know! $\endgroup$
    – user541686
    Commented Jun 11, 2012 at 20:02
  • $\begingroup$ "This is largely for historical and commercial reasons[citation needed], namely that RSA Security created a certificate authority for key signing that became Verisign. Diffie–Hellman cannot be used to sign certificates." [en.wikipedia.org/wiki/… $\endgroup$ Commented Aug 23, 2018 at 9:54
  • $\begingroup$ @Mehrdad as you wish. $\endgroup$
    – kelalaka
    Commented Jan 15, 2019 at 18:08
  • $\begingroup$ @Patriot: The "point" is to "prove" the nature of their differences? what? You realize I wrote both the question and the answer, right? $\endgroup$
    – user541686
    Commented Aug 2, 2019 at 11:22

Yes, they're both public key systems. The difference in the way that you're asking is that Diffie-Hellman relies on the hardness of taking logarithms (actually discrete logs, but just don't worry about that for now). RSA relies on the hardness of factoring.

Interestingly, the two problems are related. There are mathematical theorems that say that a structural problem in one means there's a structural problem in the other. But they are two distinct families of public key crypto, the logarithm family and the factoring family.

Elliptic curve crypto, by the way, is just logarithm-family crypto on a different finite field than modular arithmetic. If that just sailed over your head, I can explain later.


  • $\begingroup$ I would suppose this is related to the mathematical difference. Do you care to elaborate on the protocol differences? $\endgroup$
    – d-_-b
    Commented Aug 13, 2013 at 6:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.