I know we could possibly be using DH key exchange, that would enable PFS. However, what if we make modifications on our SSL 3.0 handshake such that the only cipher we use is RSA for the achieving PFS? Is it possible to modify SSL handshakes to enable PFS while still using RSA during the handshake?

  • $\begingroup$ 1) If you invent your own ciphersuite, you could use ephemeral RSA. But creating a new RSA key is much more expensive than generating a DH key. So you might want to reuse it across connections and only rotate every minute. 2) You could use the plain RSA suite to achieve a limited form of forward secrecy if you frequently obtain a new certificate. Might be expensive depending on the CA. $\endgroup$ – CodesInChaos Dec 10 '13 at 9:02
  • $\begingroup$ @CodesInChaos How is plain RSA susceptible to no-PFS whereas ephemeral RSA does provide PFS? I am using RSA , and only RSA at the handshake during TLS/SSL 3.0, so does that mean one party needs to have an ephemeral key for this to succeed? Why do you doing its much more expensive, in what sense? $\endgroup$ – Bob White Dec 10 '13 at 20:19
  • $\begingroup$ To achieve forward secrecy you need to throw away the keys you used in the handshake so your future self won't be able to decrypt the handshake anymore. Both sides need to use an ephemeral key (With RSA key-exchange the client's ephemeral key is a symmetric secret). As long as the server keeps its RSA key used in a plain RSA key-exchange, you haven't achieved forward secrecy. $\endgroup$ – CodesInChaos Dec 11 '13 at 8:30
  • $\begingroup$ Creating a new DH key is cheap: One modular exponentiation with fixed base (or the even cheaper elliptic curve equivalent). With RSA you need to create two large primes. Creating an RSA key costs only a fraction of a second, but you don't want to create a new one for each and every connection. $\endgroup$ – CodesInChaos Dec 11 '13 at 8:36
  • $\begingroup$ @CodesInChaos, would you mind writing up your comments into a proper answer so this question gets off of our statistic of "unanswered questions"? $\endgroup$ – SEJPM Jun 28 '15 at 19:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.