# Why is Diffie-Hellman used instead of just RSA in key-exchange (TLS, IKE)?

Why should a key exchange protocol (such as in TLS or IKE) use Diffie Hellman? Why not just use RSA? For example: Alice picks a random session key, signs it, encrypts it with Bob's public key, and sends it to Bob. Why introduce Diffie-Hellman? What does DH add?

• If we have AES, why we have other symmetric encryption algorithms? Jun 15 '16 at 5:19
• Jun 15 '16 at 12:05

Perfect Forward Secrecy.

That is, suppose you have a secure session with the server Bob, and then you close the session down. Then, someone steals the server (or serves a warrant to the owner). If you use RSA to transport the random session key, well, the server still has the RSA private key, and so they'll be able to decrypt your session.

In contrast, assuming that the server and the client zeroizes the DH private values at the end of negotiation, they can't - no one is able to rederive the session keys, even if they grabbed both the client and the server.

Now, it's possible to do this with RSA (by zeroizing the old RSA private key, and generating a fresh one periodically); however generating RSA key pairs is expensive, and so no one does that - they use DH instead.

• I also want to add that, some DH cipher suites in TLS does not provide Perfect Forward Secrecy(PFS) too. Cİpher suites which use DH_RSA or DH_DSS key exchange methods do not support PFS (ex. TLS_DH_RSA_WITH_AES_256_CBC_SHA). Jun 15 '16 at 5:30
• @Makif or to put it positively, you need Ephemeral suites: DH*E*_{RSA,DSS} or Elliptic Curve ECDH*E*_{RSA,ECDSA} (sorry can't get the markdown to work without 'code'). The 'anonymous' suites with DH_anon and ECDH_anon are actually ephemeral, but with no authentication they don't ensure current secrecy making forward secrecy less important. If using older openssl, be aware in some cases it (mis)spells DHE as EDH in suitenames. Jun 15 '16 at 12:14