Cryptology Academy · Lesson

ECDH: Elliptic Curves for Key Exchange

Apply elliptic-curve scalar multiplication to ECDH key agreement.

Lesson 3 of 413 steps

ECDH: Elliptic Curves for Key Exchange is a free Cryptology Academy lesson on CoddyKit. This is lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cryptology Academy learning path, and your progress syncs across the web and the CoddyKit app. The Cryptology Academy course includes 4 lessons in total.

Welcome

ECDH replaces DH's multiplicative group with an elliptic curve group. The result: equivalent security with 10× smaller keys and 10× faster operations.

EC Group Operations

In ECDH, the 'multiplication' is elliptic-curve scalar multiplication: multiplying a point P by a scalar k means adding P to itself k times: k×P. This is the EC analog of g^k mod p.

ECDH Protocol

Agree on curve E and base point G (public). Alice: private key a, public key A = a×G Bob: private key b, public key B = b×G Alice: S = a×B = a×b×G Bob: S = b×A = b×a×G Both derive the same point S.

ECDLP

Given A = a×G on an elliptic curve, find a. This is the Elliptic Curve Discrete Log Problem. No sub-exponential algorithm is known for general curves, making ECDLP harder than DLP at equal key sizes.

Curve25519

Designed by Bernstein in 2005. Montgomery form: y²=x³+486662x²+x over the prime 2^255-19. Designed to be fast and resistant to implementation errors. Used in WireGuard, Signal, SSH.

X25519 Key Exchange

X25519 is the ECDH function using Curve25519. Only the x-coordinate of the shared point is used (cofactor multiplication handles edge cases). RFC 7748 standardized X25519 and X448.

ECDH in Python

from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PrivateKey alice_priv = X25519PrivateKey.generate() bob_priv = X25519PrivateKey.generate() alice_pub = alice_priv.public_key() bob_pub = bob_priv.public_key() shared_alice = alice_priv.exchange(bob_pub) shared_bob = bob_priv.exchange(alice_pub) assert shared_alice == shared_bob

Shared Point to Symmetric Key

The raw shared point is not used directly as a key (it's not uniformly distributed). Use HKDF to derive a proper symmetric key: from cryptography.hazmat.primitives.kdf.hkdf import HKDF key = HKDF(SHA256, 32, salt, info).derive(shared_secret)

ECDH vs DH Key Sizes

Security level 128-bit: - DH: 3072-bit prime - ECDH: 256-bit curve Key size ratio: ~12:1. ECDH public key: 32 bytes (Curve25519). DH public key: 384 bytes. ECDH private key operations are ~50× faster.

Cofactor Attack on Bad Curves

Small subgroup attacks exploit curves with non-trivial cofactors. Curve25519 has cofactor 8 but X25519 handles this correctly. NIST P-curves have cofactor 1. Always use standardized implementations.

ECDH in TLS 1.3

TLS 1.3 supports: X25519, X448, P-256, P-384, P-521 for key exchange. X25519 is the most common — fast, secure, constant-time. Both peers generate ephemeral keys for each session.

Quick Check

What is the primary advantage of ECDH over classical Diffie-Hellman?

Answer it in the interactive lesson

Recap

ECDH mastered! Next we understand forward secrecy and why ephemeral key exchange is essential in TLS.

Free to start

Learn Cryptology Academy with an AI tutor — free

Write and run real code in your browser, get instant help from a 24/7 AI tutor, and pick up where you left off on the web or in the app.

Courses: 67
Lessons: 261

Start learning free View the full course

Frequently Asked Questions

Is the “ECDH: Elliptic Curves for Key Exchange” lesson free?

Yes — the full text of “ECDH: Elliptic Curves for Key Exchange” is free to read here on the web. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cryptology Academy course, upgrade to CoddyKit PRO. The Cryptology Academy course includes 4 lessons in total.

What will I learn in “ECDH: Elliptic Curves for Key Exchange”?

Apply elliptic-curve scalar multiplication to ECDH key agreement. You practise Cryptology Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cryptology Academy?

No prior experience is required. Cryptology Academy on CoddyKit is structured for beginners through advanced learners, so you can start here or from the beginning and move at your own pace. This is lesson 3 of 4.

How long does the “ECDH: Elliptic Curves for Key Exchange” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cryptology Academy lesson?

Yes. Every Cryptology Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

The Key Distribution Problem
Diffie-Hellman Key Exchange Math
ECDH: Elliptic Curves for Key Exchange
Forward Secrecy & Ephemeral Key Exchange

← Back to Cryptology Academy