ECDHE
acronymcryptography
Stands for: Ephemeral Elliptic-Curve Diffie-Hellman
A key-exchange method that gives every session its own throwaway keys, so past traffic stays safe if a long-term key leaks.
Ephemeral Elliptic-Curve Diffie-Hellman (RFC 8422) is the standard forward-secret key exchange in modern TLS. The 'ephemeral' part means the keys exist only for one session, which is what provides forward secrecy; the elliptic-curve part makes it fast with small keys.
ECDHE is how modern TLS agrees on a session key, and the final E is the part that matters: ephemeral. A fresh key pair is generated for each session and discarded afterwards, so the session key exists nowhere once the connection ends.
That property is forward secrecy, and its value is retrospective. Under the older RSA key transport, an adversary could record encrypted sessions for years and decrypt every one of them the day they obtained the server's private key. With ephemeral exchange there is no such master key: compromising the server tomorrow reveals nothing about traffic captured today, because the material needed to decrypt it was never stored.
This is why TLS 1.3 removed static RSA key exchange entirely rather than deprecating it politely. The performance objection that once justified non-ephemeral modes disappeared as elliptic curve operations became cheap, so the trade that made the old choice defensible no longer exists. The hybrid post-quantum schemes now deploying pair ECDHE with ML-KEM, keeping the classical guarantee while adding a quantum-resistant one.
Also known as: ecdhe, ECDHE_ECDSA, ECDHE_RSA