Static vs ephemeral diffie-hellman

Question

I feverishly searched the web and couldn't find a clear explanation about what exactly is "Ephemeral diffie-hellman". Let's briefly recall how diffie-hellman basically works:

1. Bob and Alice agree publicly on a generator ($g$) and a prime modulo ($p$)
2. Bob selects a private integer ($b$) and computes $B=g^b \bmod p$. He then passes $B$ publicly to Alice
3. Alice selects a private integer ($a$) and computes $A=g^a\bmod p$. She then passes $A$ publicly to Bob.
4. Bob computes $K = A^b\bmod p$
5. Alice computes $K = B^a\bmod p$

So now Bob and Alice both have $K$.

The explanations I see on the web are all sorts of:

Ephemeral Diffie-Hellman (DHE in the context of TLS) differs from the static Diffie-Hellman (DH) in the way that static Diffie-Hellman key exchanges always use the same Diffie-Hellman private keys. So, each time the same parties do a DH key exchange, they end up with the same shared secret.

First to verify some issue: Are "private keys" in the context of diffie-hellman refer to the private $a$ and $b$ that Alice and bob privately select respectively? I'll assume they do, if not - correct me please.

Now, what I don't understand here is, what does it mean that "static DH exchanges always use the same Diffie-Hellman private keys."? I mean:

1. What is considered an exchange? A session of information exchanging between to parties?
2. If so, does static DH refer to exchanges between the same two parties?
3. If not so, considering that, seemingly, using static DH also requires the use of the same $g$ and $p$, how does using static DH will always generate the same $K$?

It'll be great if someone could clarify this whole subject. Thanks

Answer 1

Are "private keys" in the context of diffie-hellman refer to the private $a$ and $b$ that Alice and bob privately select respectively?

Yes, correct. Similarly, $A=g^a\bmod p$ and $B=g^b\bmod p$ are also called the "public keys".

What is considered an exchange? A session of information exchanging between to parties?

An exchange is an execution of the Diffie-Hellman protocol. This happens whenever either a party feels like it or a party has forgotten the resulting shared secret from the last execution. In the context of the internet this usually means that if you connect to, say, Stack Exchange today it will run a Diffie-Hellman exchange. Then when you shutdown your computer it will "forget" the resulting shared secret $K$ and tomorrow when you connect to Stack Exchange again, it will have to run another Diffie-Hellman exchange.

If so, does static DH refer to exchanges between the same two parties?

In a static exchange usually both parties always reuse their private keys, which implies that if they re-run the Diffie-Hellman exchange more than once with each other they always get the same shared secret $K$.

Indeed getting a shared secret the same shared secret between Alice and Bob and Alice and Charlie has a negligible probability if everyone involved picked their private keys properly and the protocol was followed.

Answer 2

I believe Perfect Forward Secrecy (PFS) provides protection against future key leaks. In static Diffie-Hellman (DH) exchanges, the server exponent remains constant. If this parameter is compromised, it allows rerunning the exchange using client public data. On the other hand, in ephemeral DH exchanges, both parties generate a random secret each time, resulting in new public keys for every connection