The DH equation is:

$$ K = g^{xy} \bmod p$$

Does using DHE mean even the $g$ and $p$ parameters are randomly generated (instead of being fixed)? Is this the difference?


1 Answer 1


Using DHE means even the $g$ and $p$ parameters are randomly generated

No, that's not what DHE means.
They may be randomly generated, but as this is a very expensive process (because you need to find a safe prime), computationally seen, you usually don't do this.
What you do in DHE is that both parties pick random values for $x$ and $y$ at run-time (e.g. protocol execution).

However, when you're doing a DH (without the "E") key exchange, the server has a certificate, which embeds a static, public Diffie-Hellman key, i.e. $g^x\bmod p$ as well as $g$ and $p$ allowing you to save an additional signature (e.g. using RSA or ECDSA) to verify the authenticity of the DH parameter. So while the server's DH value is static, the client still usually chooses a random value for security and storage-reduction reasons. Obviously fixing the parameters in the certificate implies they can't be changed at run-time.

Please note: Static-Ephemeral DH is very rarely used these days (especially with TLS).

Please note: this answer uses the TLS terminology for DH and DHE, in many other applications static DH isn't a thing and DHE is always used and just labeled as "DH".

  • 1
    $\begingroup$ TLS 1.3 (draft) mandates ephemeral-ephemeral key exchange to obtain forward secrecy. ECDH works the same way, domain parameters fixed, and the public / private values generated at random, with the advantage that generating $x$ and $y$ as well as the key agreement itself is more efficient. $\endgroup$
    – Maarten Bodewes
    Sep 15, 2016 at 12:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.