Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Wikipedia's TLS article says:

The client responds with a ClientKeyExchange message, which may contain a PreMasterSecret, public key, or nothing. (Again, this depends on the selected cipher.) This PreMasterSecret is encrypted using the public key of the server certificate.

The parenthetical remark is interesting. It implies that if there is no premaster secret (which I believe is the case for a DHE key exchange), then the server's public key is not used. However, the server needs to prove that it has the corresponding private key. So where does that proof happen in the protocol if RSA key exchange is not being used?

share|improve this question

When a (EC)DHE (non-anon) cipher suite is used, the server's public key is used to verify the signature of the ServerDHPublic. Diffie-Hellman is an anonymous key-exchange protocol. A signature is used to make sure that the client is talking with who he thinks to talk and no MITM attack has took place.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.