Diffie-Hellman Key Exchange

Diffie-Hellman enables two parties to jointly establish a shared secret over a completely public communication channel without any prior shared secrets. Each party generates a private key (kept secret) and a corresponding public key (shared openly). The magic of the protocol is that both parties compute the same shared secret by combining their private key with the other party's public key, while an eavesdropper observing both public keys cannot feasibly compute the secret.

• Based on the computational hardness of the discrete logarithm problem
• Foundation for forward secrecy in TLS and secure messaging
• Enables pairwise masking in secure aggregation without pre-shared keys

The security of classical Diffie-Hellman rests on the computational intractability of the discrete logarithm problem in carefully chosen mathematical groups. Given a generator g and a value g^a mod p, recovering the exponent a is computationally infeasible for sufficiently large prime moduli. This one-way function property means that public keys reveal no usable information about private keys.

• Typically implemented over multiplicative groups of finite fields or elliptic curve groups
• Elliptic Curve Diffie-Hellman (ECDH) offers equivalent security with much smaller key sizes
• Quantum computers running Shor's algorithm would break this assumption, motivating post-quantum alternatives

In secure aggregation protocols, Diffie-Hellman key agreement enables each pair of clients to establish a unique shared secret. These secrets seed pseudorandom generators (PRGs) that produce masking vectors added to model updates before transmission. Because each pair agrees on the same mask, and masks are constructed to cancel out in the final sum, the server sees only the aggregate.

• Each client pair (u, v) runs DH to derive a shared seed s_{u,v}
• Masks are generated as PRG(s_{u,v}) and added with appropriate signs
• If client u adds the mask and client v subtracts it, the masks sum to zero globally
• Requires quadratic O(n²) key agreements per round for n clients

ECDH adapts the Diffie-Hellman protocol to use elliptic curve groups instead of multiplicative groups modulo a prime. The core operation becomes scalar multiplication of a curve point rather than modular exponentiation. ECDH provides equivalent security to traditional DH with dramatically smaller key sizes—a 256-bit ECDH key offers security comparable to a 3072-bit finite-field DH key.

• Standardized curves include Curve25519 and P-256
• Faster computation and lower bandwidth make ECDH ideal for mobile and IoT clients in federated learning
• Widely used in modern protocols including TLS 1.3, Signal, and secure aggregation implementations

Diffie-Hellman provides forward secrecy when ephemeral key pairs are generated for each session and discarded after use. Even if a client's long-term identity key is later compromised, past session keys cannot be recovered because the ephemeral private keys used to derive them are no longer available. In secure aggregation, this means that compromising a device does not expose previously transmitted model updates.

• Ephemeral-static DH: one party uses a fresh key, the other uses a long-term key
• Ephemeral-ephemeral DH: both parties generate fresh keys per session—strongest forward secrecy
• Critical for protecting historical training data in long-running federated learning deployments

Basic Diffie-Hellman provides no authentication of the communicating parties, making it vulnerable to man-in-the-middle (MITM) attacks where an adversary intercepts and replaces public keys. In secure aggregation, this is mitigated by combining DH with digital signatures and a public key infrastructure (PKI). Each client signs their DH public key with their identity key, allowing recipients to verify authenticity before computing the shared secret.

• Authenticated DH requires binding public keys to verified identities
• Secure aggregation typically uses a trusted third party or PKI for key distribution
• The combination of DH + signatures provides both key establishment and entity authentication

A cryptographic protocol allowing two or more parties to establish a shared secret key over an insecure communication channel without prior shared secrets. Diffie-Hellman is the canonical example.

• Enables pairwise masking in secure aggregation
• Foundation for establishing encrypted tunnels between clients
• Does not require a pre-existing trusted infrastructure
• Security relies on the computational hardness of the discrete logarithm problem

The mathematical foundation of DH security. Given a prime modulus p, a generator g, and a value y = g^x mod p, finding x is computationally infeasible for sufficiently large parameters.

• Underpins the one-way function in DH exchange
• Classical computers require sub-exponential time to solve
• Shor's algorithm on quantum computers breaks this assumption
• Drives parameter selection for 2048-bit or larger primes

A variant of DH using elliptic curve cryptography instead of modular arithmetic over integers. ECDH provides equivalent security with significantly smaller key sizes.

• Curve25519 and P-256 are widely deployed curves
• 256-bit ECDH keys offer security comparable to 3072-bit DH
• Faster computation and lower bandwidth overhead
• Preferred for mobile and IoT federated learning clients

A security property ensuring that compromise of long-term keys does not reveal past session keys. Ephemeral DH (DHE) generates fresh key pairs per session.

• Protects previously transmitted model updates if a device is later compromised
• Each training round uses a new ephemeral key pair
• Prevents retrospective decryption of archived ciphertexts
• Mandatory in modern protocols like TLS 1.3

A technique in secure aggregation where each pair of clients agrees on a shared secret mask using DH key exchange. These masks are added to model updates and cancel out in the final sum.

• Masks are generated via a pseudorandom generator (PRG) seeded with the DH shared secret
• Server sees only masked individual updates
• Requires O(n²) key agreements for n clients
• Combined with secret sharing for dropout resilience

DH and ECDH are vulnerable to Shor's algorithm on sufficiently large quantum computers. Migration to post-quantum key agreement is an active area of research.

• CRYSTALS-Kyber is a NIST-standardized post-quantum KEM
• Hybrid schemes combine ECDH with lattice-based key encapsulation
• Learning With Errors (LWE) problem underpins quantum-resistant alternatives
• Transition planning is critical for long-lived privacy guarantees