I read that TLS does PFS using Diffie Hellman. However, DH can be used even without certificates - so how is DHE-RSA better than plain DHE?
Is DHE a insecure algorithm, that DHE-RSA is needed?
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.Sign up to join this community
No, DHE is secure and allows to share a common secret between two parties over an insecure channel. But you cannot know, if the one you share the secret with is the one you want (DHE is vulnerable to man in the middle attacks). So DHE-RSA uses DHE to share a common secret and signs the communication with RSA to make sure, that both persons communicate with the right other person.
So in short: DHE does not provide authenticity. DHE-RSA does.
To use the proper terminology: in TLS, cipher suites which include "some Diffie-Hellman" are:
There is no "plain DHE" cipher suite in TLS; it is called "DH_anon". As the name indicates, with DH_anon, the server is "anonymous": you don't really know who you are talking to. You talk securely to somebody, but that somebody may be an active attacker, so the term "securely" must be taken with a grain of salt. DH_anon is strong against passive attackers (who listen but do not talk), but contexts where attackers can only be passive are quite rare.
Nobody uses static DH, because static DH involves certificates with DH public keys in them, and that's hardly ever supported anywhere (in practice everybody does RSA, with a few adventurous people looking towards switching to ECDSA in the mid-term future).
Ephemeral Diffie-Hellman (the "DHE" cipher suites proper) is like DH_anon except that the server also has a certificate and signs its DH public key (the DH public key that it just generated and will soon forget, hence "ephemeral"); and the client verifies that certificate and that signature. This brings back authentication (the client now knows to whom it is currently talking) and thus security.