I have read a few tutorials in regards to this. My understanding is that Diffie-Hellman is a key exchange concept that is being use everywhere in our daily lives, which is also known as the public-private key exchange.

In a real world example. when I want to send an email- keys would also be exchanged.

For example - me: alice@gmail.com friend: bob@gmail.com

If I wanted to send a message from alice to bob... Who actually generates "Bob" public key and "my/alice" private key? Is it my computer that send the email, or the google mail servers? Is there a way to check my own private key? I am assuming private keys are not a fixed constant and changes over time?


Diffie-Hellman key agreement requires you to exchange messages to agree upon a (master) secret. As email is for conversations between humans, DH-key agreement is generally not used for keeping mail confidential. Instead the data is commonly encrypted using hybrid encryption, using for instance a combination of RSA and AES encryption.

For this to work the sender has to trust the public key of the receiver. This is commonly accomplished using certificates within a PKI scheme such as PKI-X. PKI-X is well known as it is also used by your browser; it's a hierarchical way of establishing trust in certificates containing the public keys of the owners of the certificate. Other schemes of establishing trust is a web-of-trust, where multiple persons show their trust in certain certificates. PGP is the most prevalent use of a web of trust.

If the message also needs to be signed then you have to trust the public key of the sender. The method of establishing trust is identical.

Public and private keys are part of a key pair. There is no way of generating them separately: the key pair is generated by performing key pair generation. The private key is always kept at one party. This party distributes the public key so it can be signed by others, establishing the trust. The public key can then be distributed to any other party in any way. With email you could simply send a signed certificate containing the public key, the owner, expiry date (etc. etc.).

Finally the mail message needs to be send using a well known format. These formats can be CMS for PKI-X certificates and of course OpenPGP for PGP certificates.

If you want to see where key agreement is used you'd better look at the DH_, DHE_, ECDH_ and ECDHE_ ciphersuites in TLS versions 1.2 and 1.3; they are commonly used for transport security in other words.

|improve this answer|||||
  • $\begingroup$ Hi, since BT devices doesn't have any "internet" access... how are the public key and private key generated? is it by a internal Random number generator... and how often does this get changed? Upon every new pairing i assume (for pairing keys)?.. $\endgroup$ – Faisal Nov 23 '17 at 11:28
  • $\begingroup$ What do you mean with "BT devices"? Yes, normally you use a local random number generator. How often do the key pairs get refreshed? That depends. $\endgroup$ – Maarten Bodewes Nov 23 '17 at 11:38
  • $\begingroup$ My scenario of Diffie-Hellman is related to pairing of Bluetooth device and another smartphone (potentially also doesn't have access to internet). Hence I was wondering how the key pairs are generated from. Also specific to BT scenario, how long does the BT link key kept until its regenerated again. Depends on..? $\endgroup$ – Faisal Nov 23 '17 at 11:42
  • $\begingroup$ Right, so you randomly chose email as example domain instead of BT? Sheesh, I'm out. You really start reading into DH before asking these kind of questions. $\endgroup$ – Maarten Bodewes Nov 23 '17 at 11:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.