# Why use Diffie-Hellman key exchange over RSA (or any public-key encryption)?

In Diffie-Hellman key agreement between Alice and Bob, Alice computes and sends $g^a$ to Bob, and Bob computes and sends $g^b$ to Alice. Alice then computes $(g^b)^a$, and Bob computes $(g^a)^b$; $g^{ab}$ is their shared key. But this is vulnerable to man-in-the-middle attack.

To overcome the man-in-the-middle, suppose Alice and Bob use RSA signature scheme with their public keys signed by certificate authority. That is, Alice signs $g^a$ and Bob signs $g^b$. But if they're going to use RSA anyway, why even use Diffie-Hellman in the first place? Alice could just generate a random number (to be their shared key), sign it, encrypt it with Bob's public key, and send it to Bob.

Thank you!

• – user991 Dec 15 '15 at 6:23