Elliptic-curve Diffie–Hellman (ECDH) lets two parties calculate the same shared secret using their own private values and each other’s public values—without sending the private values. ECDH is a key-agreement method, not an encryption method or proof of identity. A protocol must handle authentication and turn the shared secret into usable keys.
How does ECDH work?
ECDH uses arithmetic on an elliptic curve. Both parties use the same curve and a common base point, usually written as G. Each chooses a private scalar and derives a public point from it.
As an Amazon Associate I earn from qualifying purchases.
- Alice chooses private scalar a and calculates public point A = aG.
- Bob chooses private scalar b and calculates public point B = bG.
- They exchange the public points. Alice calculates aB; Bob calculates bA.
- Both calculations produce abG, the same shared result.
The private scalars stay with their owners. The security relies on the difficulty of deriving a private scalar from its public point. NIST describes ECDH as a key-establishment scheme based on the discrete-logarithm problem; NIST SP 800-56A Rev. 3 covers elliptic-curve key-establishment schemes.
What ECDH does—and does not—provide
- It establishes shared secret material. The two sides can independently arrive at the same result.
- It does not encrypt messages by itself. A protocol generally derives encryption or other cryptographic keys from the shared result.
- It does not identify the other party. Without suitable authentication, an active attacker could intercept the exchange and establish separate secrets with each side.
- It does not automatically produce every application key. A key-derivation function processes the shared secret into keying material, often incorporating context required by the protocol. NIST SP 800-56C Rev. 2 addresses deriving keying material from shared secrets produced by schemes including those in SP 800-56A.
Authentication, transcript protection and any key-confirmation steps belong to the surrounding protocol. ECDH should not be treated as a complete secure-communication system on its own.
#1 Best Overall
Which curves are used for ECDH?
The curve is part of the agreement: both parties and the protocol must use compatible parameters and public-value encodings. Curves are not interchangeable simply because they all support elliptic-curve arithmetic.
RFC 7748, published in January 2016, specifies Curve25519 and Curve448 for Diffie–Hellman use. It describes their approximate security levels as 128 bits and 224 bits, respectively. These are design-level descriptions in the RFC, not assurances that every implementation is equally secure. The RFC notes that the curves support constant-time implementations and scalar multiplication designed to resist a range of side-channel attacks, including timing and cache attacks; real-world protection still depends on the implementation and protocol.
What should an implementation get right?
- Protect private scalars. Generate them with secure randomness and keep them secret. Weak randomness can undermine the exchange.
- Follow the protocol’s curve and encoding requirements. Use the parameters required by the system or applicable standard; do not substitute another curve or encoding on assumption of compatibility.
- Handle public inputs correctly. Validate or process received values as required by the chosen curve and protocol, including their rules for invalid or low-order inputs.
- Derive keys rather than treating the raw result as an application key. Use the protocol’s specified key-derivation function and bind the required context.
- Account for side channels and authentication. Constant-time operations can reduce some implementation risks, but they do not authenticate a peer or eliminate every practical vulnerability.
Which standard applies?
The relevant guidance depends on the protocol, curve, jurisdiction and compliance profile. NIST SP 800-56A Rev. 3 covers discrete-logarithm-based key-establishment schemes over finite fields and elliptic curves, while SP 800-56C Rev. 2 covers derivation of keying material from the resulting shared secret. NIST’s publication pages record decisions dated January 6, 2026, to update SP 800-56A and revise SP 800-56C. For compliance-sensitive work, check the current revision and applicable profile rather than assuming these editions remain the final guidance.
Recommended Free Tools
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
