3
$\begingroup$

From Wikipedia's article on ECDH:

The public keys are either static (and trusted, say via a certificate)…

Also see this question on this very site.

These indicate to me that a certificate (maybe an X.509 certificate) can have a(n) (elliptic curve) Diffie-Hellman public key as the data that is authenticated by it. Is this true?

Improve this question
$\endgroup$
1
  • $\begingroup$ As I said there, ECC key is the same for ECDH and ECDSA (also ECIES and ECMQV); see tools.ietf.org/html/rfc3279#section-2.3.5 for details. An X.509 cert may use KeyUsage to allow or deny use of the key for ECDH in TLS, and possibly S/MIME. In contrast SSH uses static ECC key only for signing, with manual trust or in OpenSSH optional cert; ECDH key agreement always uses ephemeral keys, but SSH key agreement (EC or not) is always signed. And X.509 signed data includes much more than the subject's public-key. For NON-EC DH I concur with @Maarten. $\endgroup$ – dave_thompson_085 Mar 28 '16 at 21:03
2
$\begingroup$

Yes, but it isn't that common and you may therefore have trouble finding implementations of it. Dave already pointed out in the other answer that you may need to use the OpenSSL API (which is a lower level crypto-API, not just SSL/TLS) rather than using the command line.

Please look at the following in the X509 RFC 5280:

4.1.2.7. Subject Public Key Info

This field is used to carry the public key and identify the algorithm with which the key is used (e.g., RSA, DSA, or Diffie-Hellman) (emphasis mine).

When used with TLS:

With a static DH key you would be using ephemeral-static Diffie-Hellman. That means that such a key is normally only used to authenticate the key agreement protocol. That also means that this protocol won't be providing forward secrecy.

Improve this answer
$\endgroup$
2
  • $\begingroup$ "Ephemeral-static" seems contradictory. $\endgroup$ – Melab Mar 29 '16 at 9:11
  • $\begingroup$ @Melab "Ephemeral-static" simply means that one party has a temporary (fleeting) key pair and that the other party has a static key pair. Ephemeral key pairs cannot be used for authentication as the public key is not trusted. Static key pairs can (using e.g. X509 to provide trust to the public key). NIST documents use these terms to describe various Key Agreement schemes based on Diffie-Hellman. So "ephemeral" relates to party A while "static" relates to party B. There's also ephemeral-ephemeral and static-static Diffie-Hellman. $\endgroup$ – Maarten Bodewes♦ Apr 12 '16 at 8:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.