# Key generation for DH key exchange - benefits of using KMI

Context

We need to generate a key pair in order to perform DH key exchange with the other party. Some suggest to use a KMI solution (think: AWS KMS or like) in order to generate the key pair.

Questions

1. What would be the benefits of using a separate KMI solution to generate key pair for DH key exchange?
2. Are there any benefits over on-the-fly generation using a proper library (in this context)?
3. Would there be any generic reason to keep key pair used solely for key exchange, after the key exchange has been completed?

Let's say we contact a web server. The server uses the key pair $$S_{pub},S_{pri}$$, and out client uses key pair $$C_{pub},C_{pri}$$. If the web server never changes its key pair, and we don't either, the handshake will always yield the same result. Let's hypothesize, the server could possibly have a hard-coded key pair (web servers and browsers used to have a vulnerability where the DH key pair was literally hard-coded. This has since changed but we don't wanna revert to old mistakes). Now, if I contact 2 web servers with the same keys I will always get the same private key. Thus, now each server can read my communications with the other, assuming they get the ciphertext.