Diffie-Hellman is a key-exchange protocol. If two people want to exchange some encrypted information, they first need to share a secret key to do the encryption with. The problem is, they can&#x27;t just send the key in plain-text, since any eavesdroppers would get the key too.<p>Diffie-Hellman gets around this by having each side share only part of a key, while keeping the other part secret. Both sides can then mix their own secret part with the other side&#x27;s shared part to derive a common encryption key. An eavesdropper can&#x27;t learn anything, though, since they only see the shared parts, not the critically-important secret parts.<p>The Diffie-Hellman algorithm comes in several different flavors. The current state-of-the-art is ECDH, which is fast and uses small keys. The problem is that ECDH only provides security against classical computers. If an eavesdropper has access to a big 256-bit quantum computer, they can work backwards from the shared parts to learn the encryption key.<p>Big quantum computers don&#x27;t exist yet, but they might one day. Therefore, cryptographers are busily searching for alternatives to ECDH that don&#x27;t have quantum weaknesses. We have some alternatives already, but they are either slow or require enormous keys.<p>This paper shows a way to do quantum-resistant Diffie-Hellman in a way that is <i>significantly</i> faster and smaller than anything we have see so far. It&#x27;s still a lot slower than the best ECDH (~50 million vs ~50k cycles), and they keys are still a lot bigger (751 bytes vs 32 bytes), but it&#x27;s still really impressive progress. Many of the alternatives have keys measured in KB or MB, which is obviously impractical.<p>[edit: fixed numbers]