Public Key Cryptography: Diffie-Hellman (1976) and RSA (1977)

Every time a browser shows a padlock, it relies on an idea that, before the 1970s, most cryptographers thought was close to impossible: two people who have never met can agree on a secret in public view, with an eavesdropper listening to every word. The invention of public key cryptography in the mid-1970s solved the biggest practical problem in secure communication and made the modern internet possible.

The key distribution problem

For thousands of years, encryption meant that sender and receiver shared a secret key beforehand. Whoever held the key could lock and unlock messages. That works for armies and diplomats who can send couriers with codebooks. It does not scale to a world where millions of strangers want to talk privately. If you wanted to send a secret to a bank you had never visited, how would you get the key to it safely?

By the early 1970s, the growth of computer networks made this question urgent. Banks and companies wanted to protect data in transit, and a system that required a physical key exchange for every pair of parties would be unworkable.

Diffie, Hellman and Merkle

Whitfield Diffie, a researcher with a long interest in the problem, and Martin Hellman, a professor at Stanford University, began working together in 1974. Ralph Merkle, then a student at Berkeley, had proposed a scheme of his own, known as Merkle's Puzzles, that allowed two parties to establish a shared key over an open channel, though at a cost that grew too quickly to be practical.

In November 1976, Diffie and Hellman published a paper titled "New Directions in Cryptography" in the journal IEEE Transactions on Information Theory. It described a method, now called Diffie-Hellman key exchange, that let two parties create a shared secret using only messages that anyone could read. The method relies on a mathematical operation that is easy in one direction and very hard to reverse, such as raising a number to a power in modular arithmetic. Hellman has long argued that Merkle deserves equal credit, and has suggested calling it Diffie-Hellman-Merkle key exchange.

The paper also set out the broader idea of a public key system, in which each person has two linked keys: one published openly to encrypt messages to them, and one kept private to decrypt them. At that point the authors did not yet have a working scheme for it.

RSA arrives

The working scheme came in 1977 from three researchers at the Massachusetts Institute of Technology: Ron Rivest, Adi Shamir and Leonard Adleman. Their algorithm, named RSA after their initials, is based on the difficulty of factoring a large number into two primes. Multiplying two large primes is easy. Recovering them from the product is, with known methods, extremely slow when the numbers are large enough.

RSA was described to a wide audience in Martin Gardner's column in Scientific American in August 1977, which also offered a challenge message encrypted with a 129-digit number. That challenge, called RSA-129, was eventually solved in 1994 by a group of volunteers who coordinated over the internet. The three inventors received a patent in 1983, and the company RSA Data Security was later founded to license it. The patent expired in September 2000.

RSA also introduced digital signatures in a practical form: signing with the private key lets anyone verify with the public key that a message came from you and was not altered.

The secret history at GCHQ

For two decades, the story ended there. In 1997 the British signals intelligence agency GCHQ revealed that its own researchers had found the same ideas earlier. James Ellis had proposed the concept of non-secret encryption around 1970. In 1973 Clifford Cocks devised what is essentially the RSA algorithm, and in 1974 Malcolm Williamson found a method equivalent to Diffie-Hellman key exchange. The work was classified and had no public impact until it was released, so the American academics are rightly credited with independent invention and with bringing the idea into the open.

What it made possible

• HTTPS. A browser and server use public key methods to agree on the keys for a session, which is the heart of the TLS handshake.
• Certificates. A certificate binds a public key to a domain name and is signed by a trusted authority.
• SSH. Administrators log in to servers using key pairs.
• Email and file encryption, including PGP, covered elsewhere in this series.

In practice, public key methods are slow, so they are used to set up a session key, and a faster symmetric cipher then protects the bulk of the data.

Both RSA and classic Diffie-Hellman could be broken by a large enough quantum computer running an algorithm published by Peter Shor in 1994. No such machine exists today, but cryptographers are preparing. In 2024, the US National Institute of Standards and Technology published its first standards for post-quantum algorithms, and browsers and servers are beginning to adopt them.

The lesson for site owners today

You do not need to understand the mathematics, but you do need to use it. A certificate on your domain, a valid chain and a modern TLS configuration are what turn the 1976 idea into protection for your visitors. Make sure certificates renew automatically, and that your site redirects all traffic to HTTPS. Use SSH keys instead of passwords where you manage a server, and protect private keys as carefully as you would a master password.

Practical how-to guides are collected in the knowledgebase.

In practice

Free SSL certificates from Let's Encrypt are included with Zebra Hosting plans. Learn how it all fits together on our SSL page, or read the knowledgebase for step-by-step help.