Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I read that TLS does PFS using Diffie Hellman. However, DH can be used even without certificates - so how is DHE-RSA better than plain DHE?

Is DHE a insecure algorithm, that DHE-RSA is needed?

share|improve this question
where do you read this from? Better provide the source – T.B Apr 13 '14 at 10:58
up vote 4 down vote accepted

No, DHE is secure and allows to share a common secret between two parties over an insecure channel. But you cannot know, if the one you share the secret with is the one you want (DHE is vulnerable to man in the middle attacks). So DHE-RSA uses DHE to share a common secret and signs the communication with RSA to make sure, that both persons communicate with the right other person.

So in short: DHE does not provide authenticity. DHE-RSA does.

share|improve this answer
So HTTPS with DHE-RSA means 1) One message is signed with RSA to prove authenticity of the website 2) the session key is derived using DH 3) rest of the communication is encrypted using the session key. – user93353 Apr 13 '14 at 11:13
Almost. Except for "anonymous" suites which don't authenticate at all and are rarely used, SSL/TLS always authenticates the server; the [EC]DHE-{RSA,[EC]DSA} keyexchanges do this by signing ServerKeyExchange. There is also an option to authenticate the client, by signing a hash that includes ClientKeyExchange, but this is rarely used. There is not one session key, there are at least 2 and usually more, but all derived from the single "premaster secret", produced in this case by DH; see questions 1139 and 1142 (not room for full URLs unless there's magic I don't know). – dave_thompson_085 Apr 13 '14 at 13:02

To use the proper terminology: in TLS, cipher suites which include "some Diffie-Hellman" are:

  • Anonymous Diffie-Hellman: DH_anon
  • Static Diffie-Hellman: DH-RSA, DH-DSS...
  • Ephemeral Diffie-Hellman: DHE-RSA, DHE-DSS...

There is no "plain DHE" cipher suite in TLS; it is called "DH_anon". As the name indicates, with DH_anon, the server is "anonymous": you don't really know who you are talking to. You talk securely to somebody, but that somebody may be an active attacker, so the term "securely" must be taken with a grain of salt. DH_anon is strong against passive attackers (who listen but do not talk), but contexts where attackers can only be passive are quite rare.

Nobody uses static DH, because static DH involves certificates with DH public keys in them, and that's hardly ever supported anywhere (in practice everybody does RSA, with a few adventurous people looking towards switching to ECDSA in the mid-term future).

Ephemeral Diffie-Hellman (the "DHE" cipher suites proper) is like DH_anon except that the server also has a certificate and signs its DH public key (the DH public key that it just generated and will soon forget, hence "ephemeral"); and the client verifies that certificate and that signature. This brings back authentication (the client now knows to whom it is currently talking) and thus security.

share|improve this answer
If DH-RSA is static DH & it has certs with DH public keys - then were does the RSA come in in DH-RSA? – user93353 Apr 13 '14 at 13:12
The "RSA" in "DH-RSA" qualifies the public key of the CA which issued the server's certificate. From the point of view of the client, a "DH-RSA" cipher suite means: "I want the server to have a certificate with a DH public key, and I am ready to use RSA to validate that certificate". This was supposed to be used in case a server had several DH certificates, signed with either RSA-based or DSA-based CA: the server would then choose the certificate for which the client had relevant support. This has never worked well in practice (but everybody does RSA anyway). – Thomas Pornin Apr 13 '14 at 13:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.