Diffie-Hellman, X25519, and Pairings: The Same Hidden Product
Diffie-Hellman, X25519, and pairing-based cryptography are easiest to compare if you track one thing:
the hidden product a * b
The systems represent that product in different algebraic worlds.
Open the interactive DH / ECDH / pairing explorer
| Concept | Ordinary Diffie-Hellman | Elliptic-Curve Diffie-Hellman / X25519 | Pairing version |
|---|---|---|---|
| Public starting object | Generator number g | Public curve point P | Two public curve points, often P in G1 and Q in G2 |
| Alice private secret | a | a | a |
| Bob private secret | b | b | b |
| Alice public key | g^a | aP | Could be aP |
| Bob public key | g^b | bP | Could be bQ or bP, depending on scheme |
| Alice's shared-secret calculation | (g^b)^a | a(bP) | e(aP, bQ) |
| Bob's shared-secret calculation | (g^a)^b | b(aP) | Same paired result |
| Shared result | g^(ab) | abP | e(P,Q)^(ab) |
| Main algebra rule | (g^a)^b = g^(ab) | a(bP) = abP | e(aP,bQ) = e(P,Q)^(ab) |
| Where result lives | Number/group element | Elliptic-curve point | Target group element, usually written GT |
| Typical use | Older finite-field DH | Modern secure connections | Identity-based crypto, BLS signatures, zk-SNARKs |
Ordinary Diffie-Hellman
Ordinary finite-field Diffie-Hellman starts with a public generator number:
public generator: g
Alice secret: a
Bob secret: b
Alice publishes:
A = g^a
Bob publishes:
B = g^b
Then:
Alice computes: B^a = (g^b)^a = g^(ab)
Bob computes: A^b = (g^a)^b = g^(ab)
Both sides get the same group element because exponentiation preserves the product a * b.
The X25519 Version
ECDH replaces the generator number with a public curve point:
public base point: P
Alice secret: a
Bob secret: b
Those private secrets are required. Without Alice's a and Bob's b, there is no abP shared secret to derive.
Alice publishes:
A = aP
Bob publishes:
B = bP
Then:
Alice computes: aB = a(bP) = abP
Bob computes: bA = b(aP) = abP
They both get the same curve point:
shared secret point = abP
X25519 normally converts the result into a usable byte-string key and then derives an AES or ChaCha20 encryption key from it. Strictly speaking, X25519 works with the Montgomery u coordinate and a fixed base point, but abP is the useful ECDH mental model.
The important correction is this:
aP + bP
is not the key-agreement calculation.
This is:
a(bP) = abP
Alice applies her scalar a to Bob's public point bP. Bob applies his scalar b to Alice's public point aP.
Pairing Translation
A pairing takes two curve points and produces an element in a different group:
e(P, Q) = u
The key rule is:
e(aP, bQ) = e(P, Q)^(ab)
So let:
Alice public key = aP
Bob public key = bQ
Then anyone who has both public keys can calculate:
e(aP, bQ)
and get:
e(P,Q)^(ab)
Notice the difference:
X25519:
a(bP) = abP
The shared result remains a curve-point style value.
Pairing:
e(aP,bQ) = e(P,Q)^(ab)
The result moves into the target group GT.
The Important Difference
For ordinary X25519, an outsider sees:
P, aP, bP
but cannot feasibly derive:
abP
That is the elliptic-curve Diffie-Hellman problem.
For pairings, an outsider can often calculate:
e(aP,bQ) = e(P,Q)^(ab)
from public values.
That sounds like it "breaks" Diffie-Hellman, but it does not reveal:
abP
a
b
It reveals a related value in the target group. Pairing-based systems are designed around that capability.
| Technology | What it intentionally lets you do |
|---|---|
| X25519 | Only Alice and Bob derive abP |
| Pairings | Publicly combine points into e(P,Q)^(ab) |
| BLS signatures | Verify a signature relation with pairings |
| zk-SNARKs | Verify algebraic proof relations efficiently |
| Identity-based encryption | Derive public keys from identities such as an email address |
The Core Connection
All three preserve the same hidden product:
Ordinary DH: g^(ab)
X25519 / ECDH: abP
Pairings: e(P,Q)^(ab)
The product is the same:
a * b
The representation changes:
number/group element
curve point
target group element
That is the clean mental model: same hidden product, different algebraic worlds.