4
$\begingroup$

I read that TLS does PFS using Diffie Hellman. However, DH can be used even without certificates - so how is DHE-RSA better than plain DHE?

Is DHE a insecure algorithm, that DHE-RSA is needed?

$\endgroup$
2

2 Answers 2

4
$\begingroup$

No, DHE is secure and allows to share a common secret between two parties over an insecure channel. But you cannot know, if the one you share the secret with is the one you want (DHE is vulnerable to man in the middle attacks). So DHE-RSA uses DHE to share a common secret and signs the communication with RSA to make sure, that both persons communicate with the right other person.

So in short: DHE does not provide authenticity. DHE-RSA does.

$\endgroup$
2
  • $\begingroup$ So HTTPS with DHE-RSA means 1) One message is signed with RSA to prove authenticity of the website 2) the session key is derived using DH 3) rest of the communication is encrypted using the session key. $\endgroup$
    – user93353
    Apr 13, 2014 at 11:13
  • $\begingroup$ Almost. Except for "anonymous" suites which don't authenticate at all and are rarely used, SSL/TLS always authenticates the server; the [EC]DHE-{RSA,[EC]DSA} keyexchanges do this by signing ServerKeyExchange. There is also an option to authenticate the client, by signing a hash that includes ClientKeyExchange, but this is rarely used. There is not one session key, there are at least 2 and usually more, but all derived from the single "premaster secret", produced in this case by DH; see questions 1139 and 1142 (not room for full URLs unless there's magic I don't know). $\endgroup$ Apr 13, 2014 at 13:02
3
$\begingroup$

To use the proper terminology: in TLS, cipher suites which include "some Diffie-Hellman" are:

  • Anonymous Diffie-Hellman: DH_anon
  • Static Diffie-Hellman: DH-RSA, DH-DSS...
  • Ephemeral Diffie-Hellman: DHE-RSA, DHE-DSS...

There is no "plain DHE" cipher suite in TLS; it is called "DH_anon". As the name indicates, with DH_anon, the server is "anonymous": you don't really know who you are talking to. You talk securely to somebody, but that somebody may be an active attacker, so the term "securely" must be taken with a grain of salt. DH_anon is strong against passive attackers (who listen but do not talk), but contexts where attackers can only be passive are quite rare.

Nobody uses static DH, because static DH involves certificates with DH public keys in them, and that's hardly ever supported anywhere (in practice everybody does RSA, with a few adventurous people looking towards switching to ECDSA in the mid-term future).

Ephemeral Diffie-Hellman (the "DHE" cipher suites proper) is like DH_anon except that the server also has a certificate and signs its DH public key (the DH public key that it just generated and will soon forget, hence "ephemeral"); and the client verifies that certificate and that signature. This brings back authentication (the client now knows to whom it is currently talking) and thus security.

$\endgroup$
2
  • $\begingroup$ If DH-RSA is static DH & it has certs with DH public keys - then were does the RSA come in in DH-RSA? $\endgroup$
    – user93353
    Apr 13, 2014 at 13:12
  • $\begingroup$ The "RSA" in "DH-RSA" qualifies the public key of the CA which issued the server's certificate. From the point of view of the client, a "DH-RSA" cipher suite means: "I want the server to have a certificate with a DH public key, and I am ready to use RSA to validate that certificate". This was supposed to be used in case a server had several DH certificates, signed with either RSA-based or DSA-based CA: the server would then choose the certificate for which the client had relevant support. This has never worked well in practice (but everybody does RSA anyway). $\endgroup$ Apr 13, 2014 at 13:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.