I'm putting together a talk on the history of SSL/TLS and one detail I can't find info on is when DHE key exchange was introduced. If someone was able to point to an RFC or OpenSSL version that would be helpful. There is mention of "ephemeral" in RFC 2631 but I'm not sure if this applies to SSL/TLS.
1
-
2$\begingroup$ It seems to be SSL 3.0 (1.0 was never released and 2.0 didn't include it according to this table on Wikipedia). That means it was always in the published standards, including 3.0 which was released as historical RFC. $\endgroup$– Maarten Bodewes ♦Commented Sep 3 at 23:41
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
1
The Ephemeral Diffie-Hellman (EDH) key exchange, also known as DHE (Diffie-Hellman Ephemeral), was introduced to SSL/TLS as part of the SSL 3.0 specification (page 54), which was released in 1996. This method of key exchange allows for forward secrecy, meaning that the compromise of a long-term key does not compromise past session keys.
TLS (Transport Layer Security, page 47), the successor to SSL, continued to support DHE, with its introduction in TLS 1.0 in 1999.
-
$\begingroup$ I think you mixed up the page numbers in the answer, the one for TLS needs to be the one for SSL and vice versa. $\endgroup$– Maarten Bodewes ♦Commented Sep 4 at 20:02