# Why is Diffie-Hellman used instead of just RSA in key-exchange (TLS, IKE)?

Why should a key exchange protocol (such as in TLS or IKE) use Diffie Hellman? Why not just use RSA? For example: Alice picks a random session key, signs it, encrypts it with Bob's public key, and sends it to Bob. Why introduce Diffie-Hellman? What does DH add?

• If we have AES, why we have other symmetric encryption algorithms? – Makif Jun 15 '16 at 5:19
• – dave_thompson_085 Jun 15 '16 at 12:05

• @Makif or to put it positively, you need Ephemeral suites: DH*E*_{RSA,DSS} or Elliptic Curve ECDH*E*_{RSA,ECDSA} (sorry can't get the markdown to work without 'code'). The 'anonymous' suites with DH_anon and ECDH_anon are actually ephemeral, but with no authentication they don't ensure current secrecy making forward secrecy less important. If using older openssl, be aware in some cases it (mis)spells DHE as EDH in suitenames. – dave_thompson_085 Jun 15 '16 at 12:14