How Diffie-Hellman Lets Two Computers Share a Secret Over an Insecure Network

The Diffie-Hellman key exchange protocol allows two parties to establish a shared secret over a public network without ever directly transmitting that secret. The method works by combining publicly shared values with privately held ones using modular arithmetic, making it computationally infeasible for an eavesdropper to reverse-engineer the private components. This principle underpins Phase 1 of the TLS handshake, which secures everyday HTTPS connections between browsers and web servers. However, Diffie-Hellman alone cannot verify the identity of either party, leaving connections vulnerable to Man-in-the-Middle attacks. Modern HTTPS addresses this flaw by pairing the key exchange with SSL digital certificates issued by trusted certificate authorities to authenticate the server's identity.