I once heard Terence Tao explain basically the following protocol for how Alice can send a secret to Bob over an unsecure channel without either of them meeting up beforehand to exchange keys.

Alice puts her padlock on a box and sends Bob the box. Nobody can open the box while it's in transit. Bob gets the box and can't open it because he doesn't have Alice's key. He adds his padlock and sends it back to Alice. Alice now can't open her own box because she doesn't have Bob's key. She removes her padlock and sends it back. Bob can now remove his padlock and access the secret contents.

What is the name of this protocol? It doesn't seem to be the Diffie-Hellman exchange or the DSA. The padlocks presumably represent a pair of commuting, invertible secret functions $f$ and $g$.

  • $\begingroup$ Maybe this? $\endgroup$ Oct 7, 2020 at 10:29
  • $\begingroup$ @HennoBrandsma As often happens with me, I figured out what keywords to google three minutes after posting the question. $\endgroup$
    – Jack M
    Oct 7, 2020 at 10:32

1 Answer 1


This is called a three-pass protocol.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .