Why use Diffie-Hellman key exchange over RSA (or any public-key encryption)?

Question

In Diffie-Hellman key agreement between Alice and Bob, Alice computes and sends $g^a$ to Bob, and Bob computes and sends $g^b$ to Alice. Alice then computes $(g^b)^a$, and Bob computes $(g^a)^b$; $g^{ab}$ is their shared key. But this is vulnerable to man-in-the-middle attack.

To overcome the man-in-the-middle, suppose Alice and Bob use RSA signature scheme with their public keys signed by certificate authority. That is, Alice signs $g^a$ and Bob signs $g^b$. But if they're going to use RSA anyway, why even use Diffie-Hellman in the first place? Alice could just generate a random number (to be their shared key), sign it, encrypt it with Bob's public key, and send it to Bob.

Thank you!

Answer 1

Alice could just generate a random number (to be their shared key), sign it, encrypt it with Bob's public key, and send it to Bob.

I, as an eavesdropper, can capture this exchange. In fact, I can capture many of these as I want with other people communicating with Bob. Then, fast forward to some point in the future, if I can compromise Bob's private key, I can now decrypt all those past communications using Bob's compromised private key. Additionally, I can compromise all new secure communications with Bob (since I have his private key, I can do it on the fly, no need to wait).

Compare this with the DH over RSA case, where as you say, Alice and Bob sign the DH elements they transfer to one another. I capture this information as it is transiting the wire and save it. Again, fast forward to some point in the future where I have compromised Bob's private key. What can I do now? Well, I can still MITM subsequent connections as I can masquerade as Bob having his private key. But what about all those prior sessions? There is nothing I can do with those as they have already occurred. There is nothing to decrypt with Bob's private key.

As Ricky pointed out in the comments, this is a property of secure communications knowns as forward secrecy. If long-term private keys have not been compromised at the time of the handshake, going forward even if those private keys do get compromised, our prior sessions are still secure.

Answer 2

If you want to use elliptic curve cryptography. In "normal" cryptography times (x) is used as the operator between numbers. DH works with powers, RSA with prime numbers. In elliptic curve cryptography addition (+) is used as the operator between points. In "normal" DH a^n (a to the power n, so axax...xa) is used, and is replaced in "elliptic" DH by nxP (n times P, so P+P+...+P). Here a is an integer number, and P a point on the elliptic curve, and n a positive integer number. So we can do DH on elliptic curves! But for prime numbers there is no analog with +, so with elliptic curve cryptography there is no RSA. So we can only use DH for the symmetric key exchange.