kex

Key exchange, abbreviated kex, is a class of cryptographic techniques that enable two or more parties to establish a shared secret over an insecure channel. That secret is used to derive symmetric keys for encrypting and authenticating subsequent communication. The central challenge is to produce a common value that both sides know but an eavesdropper cannot deduce, even if the channel is observed by an attacker.

In a typical kex protocol, participants negotiate a method, exchange public data, and compute the same secret from their private values and the received information. Most widely deployed schemes rely on the difficulty of certain mathematical problems, such as the discrete logarithm problem in a finite group or the properties of elliptic curves. Ephemeral (one-time-use) key exchanges provide forward secrecy because the private keys are not reused across sessions.

Kex is a component of higher-level protocols such as Transport Layer Security (TLS), Secure Shell (SSH), and IPsec. It is usually combined with authentication to prevent man-in-the-middle attacks; the other party proves its identity with a certificate or a shared key. Software often refers to the negotiated method as the kex algorithm or key-exchange mechanism. In configuration settings, kex terms label the key-exchange method being negotiated between peers.

Security considerations include ensuring proper parameter sizes, resistance to active interception, and protection against replay. Forward secrecy and strong authentication are core goals of modern kex designs. Ongoing research also covers post-quantum key exchange methods to withstand future quantum-era threats.