Diffie-Hellman comparison

One hidden product, three algebraic worlds.

These systems preserve the hidden scalar relationship a * b. The operations and public inputs are visible, but a, b, and the raw product a * b remain private. What changes is the encoded result: g^(ab), abP, or e(P,Q)^(ab), and who is meant to compute it. RSA is shown as a nearby contrast: it hides a factorization trapdoor, not the same hidden product.

Publicoperator, g/P/Q, public keys

Privatea, b, raw a * b

Encoded resultDH/ECDH: private to Alice and Bob; pairing: often public

RSA contrastpublic n,e; private p,q,d

Read blog

Ordinary DH

Numbers in a finite group

shared = g^(ab)

Alice applies her secret exponent to Bob's public value. Bob does the symmetric calculation.

ECDH / X25519

Points on an elliptic curve

shared = abP

The same hidden product appears as scalar multiplication of a public base point.

Pairings

Public map into GT

shared-like value = e(P,Q)^(ab)

The result moves into a target group, and public keys can often be combined publicly.

RSA contrast

Trapdoor from factorization

n = p*q; e*d = 1 mod lambda(n)

RSA belongs nearby, but it hides the factors and private exponent, not a two-party hidden product.

Bitcoin address

Hash a secp256k1 public key

Base58Check(0x00 || HASH160(pubkey))

Legacy P2PKH addresses use SHA-256, RIPEMD-160, a version byte, and a checksum.

Ethereum address

Take the last 20 bytes

last20(Keccak256(pubkey_x || pubkey_y))

Ethereum hashes the uncompressed secp256k1 public key without the leading 0x04 byte.

Comparison matrix

Same hidden product, with RSA shown as a trapdoor contrast.

RSA is useful to compare because it is also asymmetric crypto, but the secret is different: knowingp and q lets you compute the private exponent d. It is not trying to preserve or expose an encoded a * b relationship.

System	Protocol shape	Public starting object	Private input(s)	Public output(s)	Calculation	Result	Main algebra or hash rule	Where result lives	Typical use
Ordinary Diffie-Hellman	Two-party key agreement	Generator number g	Alice secret a and Bob secret b	Alice publishes g^a; Bob publishes g^b	Alice computes (g^b)^a; Bob computes (g^a)^b	g^(ab)	(g^a)^b = g^(ab)	Number/group element	Older finite-field DH
Elliptic-Curve Diffie-Hellman / X25519	Two-party key agreement	Public curve point P	Alice secret a and Bob secret b	Alice publishes aP; Bob publishes bP	Alice computes a(bP); Bob computes b(aP)	abP	a(bP) = abP	Elliptic-curve point	Modern secure connections
Pairing version	Public pairing relation or scheme-specific key/proof check	Two public curve points, often P in G1 and Q in G2	Scheme scalars such as a and b	Could publish aP and bQ, depending on scheme	Often compute e(aP, bQ)	e(P,Q)^(ab)	e(aP,bQ) = e(P,Q)^(ab)	Target group element, usually written GT	Identity-based crypto, BLS signatures, zk-SNARKs
RSA contrast	Trapdoor public-key encryption or signature system	Modulus n and public exponent e	Prime factors p and q, plus private exponent d	Public key (n,e), ciphertexts, and signatures	Encrypt or verify with x^e mod n; decrypt or sign with x^d mod n	Message/ciphertext/signature relation, not a hidden *ab** product	n = pq and ed = 1 mod lambda(n)	Integer modulo n	TLS history, certificates, encryption, and signatures
Bitcoin key/address	Single-account key pair and address derivation	secp256k1 generator point G	One account private scalar k	Public key K = kG, usually compressed for P2PKH	HASH160(compressed public key), then Base58Check	Bitcoin address, for example P2PKH	address = Base58Check(0x00 \|\| RIPEMD160(SHA256(K)))	Base58Check address string	Receiving funds and identifying spend conditions
Ethereum key/address	Single-account key pair and address derivation	secp256k1 generator point G	One account private scalar k	Uncompressed public key K = kG = 0x04 \|\| x \|\| y	Keccak256(x \|\| y), then take the last 20 bytes	Ethereum account address	address = last20(Keccak256(public_key_without_04))	20-byte address, usually hex with optional EIP-55 checksum casing	Account identity for balances, transactions, and contracts

Intentional capability

Pairings do not reveal the ECDH shared point.

In ordinary ECDH, an outsider seeing P, aP, and bP should not derive abP. In a pairing-friendly setting, a public observer may compute e(aP,bQ). That reveals a related target-group value, not a, b, or abP.

Technology	What it intentionally lets you do
X25519	Only Alice and Bob derive abP
Pairings	Publicly combine points into e(P,Q)^(ab)
BLS signatures	Verify a signature relation with pairings
zk-SNARKs	Verify algebraic proof relations efficiently
Identity-based encryption	Derive public keys from identities such as an email address

The crucial difference

Inputs and outputs, split by public and private.

The confusing part is that aP and bP look similar to aP and bQ, but the output visibility is different.

Input	Output
DH finite-field form Public g, g^a, g^b Private a, b	DH finite-field form Public No public shared-secret output Private g^(ab), computed independently by Alice and Bob
ECDH point form Public P, aP, bP Private a, b	ECDH point form Public No public shared-point output Private abP, computed by Alice and Bob
Pairing form Public P, Q, aP, bQ Private a, b, used to create the public points	Pairing form Public e(aP,bQ) = e(P,Q)^(ab) Private a, b, *raw a b, and abP** stay hidden
RSA Public n, e, message/ciphertext/signature Private p, q, and private exponent d	RSA Public ciphertext, signature, or verify true/false Private decrypted plaintext if using d to decrypt
ECDSA / Schnorr Public public key P, message hash z, signature (r,s) or (R,s) Private private signing key d and one-time nonce k during signing	ECDSA / Schnorr Public signature plus verify true/false Private none; d and k must not appear as outputs
Bitcoin address Public public key K, HASH160, address, or scriptPubKey Private private scalar k needed to create spending signatures	Bitcoin address Public address, locking script, or signed transaction Private none; the wallet keeps k private
Bitcoin Script Public scriptPubKey plus scriptSig / witness Private private keys for signatures, and secret preimages when required	Bitcoin Script Public pass/fail validation and a ledger state change Private none unless the script intentionally reveals a preimage
Ethereum address Public address, transaction fields, and signature Private private scalar k for the externally owned account	Ethereum address Public recovered signer address and accepted/rejected transaction Private none; k remains private in the wallet

Applications and use cases

Where these primitives show up in real systems.

The same page compares several different jobs: agreeing on a shared secret, proving algebraic relations, signing, addressing wallets, and locking coins.

Transport security

DH and ECDH create short-lived shared secrets before symmetric encryption starts.

TLS DHE and ECDHE handshakes
SSH key exchange
IPsec/IKE group negotiation

Blockchain identity and verification

Curve public keys become addresses, while pairings let many signatures or proof checks compress into one relation.

Bitcoin and Ethereum wallet addresses
Ethereum consensus BLS signatures
KZG commitments for polynomial openings

Trapdoor signatures and encryption

RSA is nearby public-key cryptography, but its hidden object is p, q, and d rather than a shared product.

Certificate signatures
PGP/GPG keys
S/MIME email encryption

Numbers in a finite group

Points on an elliptic curve

Public map into GT

Trapdoor from factorization

Hash a secp256k1 public key

Take the last 20 bytes

Same hidden product, with RSA shown as a trapdoor contrast.

Pairings do not reveal the ECDH shared point.

Inputs and outputs, split by public and private.

DH finite-field form

DH finite-field form

ECDH point form

ECDH point form

Pairing form

Pairing form

RSA

RSA

ECDSA / Schnorr

ECDSA / Schnorr

Bitcoin address

Bitcoin address

Bitcoin Script

Bitcoin Script

Ethereum address

Ethereum address

Where these primitives show up in real systems.

Transport security

Blockchain identity and verification

Trapdoor signatures and encryption