2
$\begingroup$

I am confused about the content of ClientKeyExchange in case if the key-exchange is static DH. The TLS 1.2 standard says under section 7.4.7 in https://tools.ietf.org/html/rfc5246#page-57:

If the client is sending a certificate containing a static DH exponent (i.e., it is doing fixed_dh client authentication), then this message MUST be sent but MUST be empty.

Is it always the case that static DH means that the client will send the static DH in a client Certificate? What is the client does not have a certificate?

$\endgroup$
1
$\begingroup$

Is it always the case that static DH means that the client will send the static DH in a client Certificate? What is the client does not have a certificate?

If the client does not have a certificate, then the requirement you quoted doesn't apply, as the condition "If the client is sending a certificate ..." is not met.

Instead, the DH public key is sent in the ClientKeyExchange handshake (exactly as if your DH wasn't static).

| improve this answer | |
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.