Editing Diffie–Hellman key exchange (section)

== Other uses ==

=== Encryption ===
Public key encryption schemes based on the Diffie–Hellman key exchange have been proposed. The first such scheme is the [[ElGamal encryption]]. A more modern variant is the [[Integrated Encryption Scheme]].

=== Forward secrecy ===
Protocols that achieve [[forward secrecy]] generate new key pairs for each [[session (computer science)|session]] and discard them at the end of the session. The Diffie–Hellman key exchange is a frequent choice for such protocols, because of its fast key generation.

=== Password-authenticated key agreement ===
When Alice and Bob share a password, they may use a [[password-authenticated key agreement]] (PK) form of Diffie–Hellman to prevent man-in-the-middle attacks. One simple scheme is to compare the [[Cryptographic hash function|hash]] of '''s''' concatenated with the password calculated independently on both ends of channel. A feature of these schemes is that an attacker can only test one specific password on each iteration with the other party, and so the system provides good security with relatively weak passwords. This approach is described in [[ITU-T]] Recommendation [[X.1035]], which is used by the [[G.hn]] home networking standard.

An example of such a protocol is the [[Secure Remote Password protocol]].

=== Public key ===
It is also possible to use Diffie–Hellman as part of a [[public key infrastructure]], allowing Bob to encrypt a message so that only Alice will be able to decrypt it, with no prior communication between them other than Bob having trusted knowledge of Alice's public key. Alice's public key is <math>(g^a \bmod{p}, g, p)</math>. To send her a message, Bob chooses a random ''b'' and then sends Alice <math>g^b \bmod p</math> (unencrypted) together with the message encrypted with symmetric key <math>(g^a)^b \bmod{p}</math>. Only Alice can determine the symmetric key and hence decrypt the message because only she has ''a'' (the private key). A pre-shared public key also prevents man-in-the-middle attacks.

In practice, Diffie–Hellman is not used in this way, with [[RSA (cryptosystem)|RSA]] being the dominant public key algorithm. This is largely for historical and commercial reasons,{{citation needed|date=November 2015}} namely that [[RSA (security firm)|RSA Security]] created a [[certificate authority]] for key signing that became [[Verisign]]. Diffie–Hellman, as elaborated above, cannot directly be used to sign certificates. However, the [[ElGamal signature scheme|ElGamal]] and [[Digital Signature Algorithm|DSA]] signature algorithms are mathematically related to it, as well as [[MQV]], [[Station-to-Station protocol|STS]] and the [[Internet Key Exchange|IKE]] component of the [[IPsec]] protocol suite for securing [[Internet Protocol]] communications.