Ephemeral DH Key Exchange

TLS 1.3 mandates ephemeral Diffie-Hellman: client and server each generate fresh DH key pairs per session. This gives forward secrecy — even if the long-term server private key leaks later, past sessions remain confidential.

The ClientHello carries key_share extension with one or more DH public keys (one per group the client supports).

Server replies with ServerHello containing:

• chosen cipher suite
• chosen group + server's DH public key

Both sides compute the shared secret:

shared_secret = X25519(my_private, peer_public)

For X25519 (Curve25519, 32-byte keys):

Why X25519 dominates over secp256r1:

• Simpler implementation (less footgun-prone).
• Constant-time by construction.
• ~3x faster on most hardware.

Once shared_secret is computed, it's fed into HKDF to derive handshake keys. From this point on, all messages are encrypted.

Killing static RSA: in TLS 1.2, RSA-key-transport (no DH) was common. Compromise the long-term private key → decrypt all past sessions. TLS 1.3 forbids this. Forward secrecy is mandatory.