Elliptic curve Diffie-Hellman (ECDH)

How it works

ECDH is Diffie-Hellman in the group of points of an elliptic curve. The public parameters are the curve, a base point $G$ and its order $n$. Alice picks a secret $d_A$ and publishes $Q_A = d_A G$; Bob picks $d_B$ and publishes $Q_B = d_B G$. Both compute the same point $d_A Q_B = d_A d_B G = d_B Q_A$, and its $x$-coordinate, passed through a key derivation function, becomes the shared key.

The advantage over Diffie-Hellman modulo a prime is size: no subexponential discrete logarithm algorithm is known for good elliptic curves, so a 256-bit curve gives about 128 bits of security, where a prime field needs about 3072 bits. X25519 (on Curve25519) is the most widely used form today, for example in TLS 1.3 and Signal.

Each side must check that the point it receives lies on the curve (and in the right subgroup), otherwise an attacker can send points of small order on other curves and learn the secret piece by piece (invalid curve attacks). As with Diffie-Hellman, the exchange itself is not authenticated, and Shor’s algorithm would break it on a large quantum computer.