Diffie#

Diffie-Hellman generates a shared secret between two people so that the secret cannot be seen by observing the communication. That is an important distinction:

You are not sharing information during the key exchange. You are creating a key together. This is useful for creating shared public keys in MultiSig and Ring Signature settings.

Diffie-Hellman Tuple#

Let g, h, u, v be public group elements.

The prover proves knowledge of x such that u = g^x and v = h^x

The prover picks r ←^R Z_q, computes (t₀, t₁) = (g^r , h^r) and sends (t₀, t₁) to the verifier.
The verifier picks c ←^R Z_q and sends c to prover.
The prover sends z = r + cx to the verifier, who accepts if g^z = t₀ · u^c and h^z = t₁ · v^c.

Fiat-Shamir Transformation#

You can obtain a non-interactive variant of the above protocol via a Fiat-Shamir transformation, where c = H(t₀‖t₁‖m) (for some message m to be signed).

We call this proveDHTTuple(g, h, u, v)

Uses#

Mixers#

The security of ZeroJoin is based on the Decision Diffie-Hellman (DDH) assumption, a computational hardness assumption about a certain problem involving discrete logarithms in cyclic groups.

A basic tool to restore the fungibility of digital notes.
Basic scheme, ZeroJoin, is based on ring signatures and proof of knowledge for a Diffie-Hellman tuple
Paper with contracts

Bitcoin	Ethereum	Ergo
No onchain mixing	Trusted setup-based or inefficient	Efficient, minimal trust assumptions

See ErgoMixer for more information.

Stealth Addresses#

Stealth Addresses are crafted to ensure recipient privacy during transactions. Leveraging a non-interactive Diffie-Hellman key exchange, they facilitate the creation of distinct one-time addresses for every transaction. While enabling recipients to securely receive funds, the linkage between the transactions and their original public address remains concealed, thereby significantly enhancing the recipient's privacy throughout the transactions.

See the Stealth Addresses page for more information.