1
$\begingroup$

When RSA is used for key exchange in SSL, the client basically encrypts some random data using the server's public key and and sends it to the server. This data is then used to compute the shared key which is used for symmetric encryption.

When Diffie-Helman (DH) is used on the other hand, -- are the DH public values exchanged unecnrypted? I ask this because while the client can use the server's public key to encrypt DH values to be sent to the client, the server has no such key to encrypt data being sent to the client (since typically the client has no public keys of its own).

|improve this question
$\endgroup$
4
$\begingroup$

are the DH public values exchanged unencrypted?

Yes, that are. After all, they are "public values"; there's no weakness in exposing them in the clear.

Now, we do have to be careful that they aren't modified in transit (if they can be, then someone can perform a Man-in-the-Middle attack). We do that by having the server sign its key share (using the private key of its certificate).

|improve this answer
$\endgroup$
  • $\begingroup$ what about the DH values being sent by the client? The client has no way to sign them since it has no private key of its own typically. Does this mean the client encrypts is DH values (using server public key) while the server just signs its DH values? $\endgroup$ – Minaj Jul 12 '16 at 18:45
  • $\begingroup$ @Minaj the client (usually) is not authenticated to the server and thus can't authenticate his shares in any way. The server just needs to trust that the client will detect an attacker if there's one. $\endgroup$ – SEJPM♦ Jul 12 '16 at 18:53
  • $\begingroup$ No, the client sends its DH values in the clear. Now, in the client direction, what's actually signed (if the client has a certificate) is not the DH values, but instead the master secret (which serves the same purpose) $\endgroup$ – poncho Jul 12 '16 at 18:53
  • 1
    $\begingroup$ Of course, the certificate is useless without RSA private key operation. Anybody can serve up a public certificate.... $\endgroup$ – Maarten Bodewes♦ Jul 12 '16 at 21:43
  • 1
    $\begingroup$ @Minaj+ even without client cert, TLS handshake including (EC)DHE kx is protected by Finished; see security.stackexchange.com/questions/20803/… and security.stackexchange.com/questions/61535/… and security.stackexchange.com/questions/71979/… . ... $\endgroup$ – dave_thompson_085 Jul 13 '16 at 2:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.