Definition
Diffie-Hellman, published by Whitfield Diffie and Martin Hellman in 1976, was the first practical solution to the key-distribution problem. It allows two parties, with no prior shared secret, to agree on a session key over a network being passively observed by an adversary, in such a way that the observer cannot derive the key. The mathematics rely on the difficulty of the discrete logarithm problem in classical Diffie-Hellman or the elliptic-curve discrete logarithm problem in ECDH.
How It Works
Each party generates a private value and a corresponding public value. They exchange public values, then each combines their own private value with the other's public value. The result, by mathematical design, is the same shared secret on both ends — but a passive observer sees only the public values, from which the secret cannot be derived in any reasonable amount of time.
Use in VPNs
Almost every modern VPN session begins with a Diffie-Hellman exchange. Static Diffie-Hellman is rarely used now because if the long-term private key leaks, every past session ever recorded becomes decryptable. Ephemeral Diffie-Hellman (DHE) and Elliptic-Curve Ephemeral Diffie-Hellman (ECDHE) generate fresh keys for every session, providing Perfect Forward Secrecy. WireGuard uses Curve25519, a high-performance elliptic curve designed by Daniel J. Bernstein.