It sounds like this“To use a secret key, two sides must have shared it beforehand, in person or by some safe route.”
Thinking two strangers can't agree a secret without meeting first
Why it feels right
It sounds like plain logic. A secret that has to cross an open channel can be copied on the way, so it must be passed some other way: a handshake, a courier, a sealed letter. For centuries that was true, and codebooks were carried by hand to every embassy. It seems that a lock needs the key in your pocket first.
Why it’s wrong
Not any more. With key exchange, two people who have never met can each mix a private number with a public one, swap only the mixtures, and both end up with the same secret. Someone who sees every message still can't work it out.
A worked example
In 1976, Whitfield Diffie and Martin Hellman showed that two people can agree on a shared secret over a channel that everyone watches. The trick is a sum that is easy one way and extremely hard to undo.
Work it through with small numbers. Alice and Bob agree in public on 5 and 23. Alice picks a secret 6 and sends 5^6 mod 23, the remainder after dividing 15,625 by 23, which is 8. Bob picks a secret 15 and sends 5^15 mod 23, which is 19. Alice takes Bob's 19 and works out 19^6 mod 23 = 2. Bob takes Alice's 8 and works out 8^15 mod 23 = 2. Both have 2, and neither secret was ever sent.
An eavesdropper sees 5, 23, 8 and 19, and with numbers this small could find the secrets by trying them. With numbers hundreds of digits long, undoing the step takes longer than anyone has. Every HTTPS connection starts with an exchange like this.
How to catch yourself
- You think a secret must be handed over in person before any code can work.
- You say 'but anyone listening would get the key'.
- You can't see how a secret can be made out of messages everyone reads.
What to hold instead
Two people can agree a secret number in public: each mixes a private number into a shared one, they swap the results, and each mixes in their own secret again. Both reach the same answer, and a watcher who sees every message can't.
Where you’ll meet it
- Opening a connection to a website you have never visited.
- Wondering how two phones set up a private call over the open internet.
- Reading why Diffie and Hellman's 1976 paper mattered so much.
Questions people ask
- How can two people share a secret over an open channel?
- By key exchange. Each picks a private number, combines it with an agreed public number, and sends only the result. Each then combines the other's result with their own secret, and both arrive at the same shared key.
- Who invented public key exchange?
- Whitfield Diffie and Martin Hellman published it in 1976, with Ralph Merkle's earlier ideas behind it. Researchers at the UK's GCHQ had found similar ideas a few years before, but kept them secret until 1997.