I just read this post here: Why do we need asymmetric algorithms for key exchange? that asserts that in public key cryptography when asymmetric keys are used to secure communications, for parties to agree on a common shared secret, the following method is used:
So, say you want to send me a very long message, using asymmetric encryption. Here's what you'd actually do:
(1) Pick a random key for use with a symmetric (fast) cipher. Encrypt your message using that (fast) cipher and key. Send me that encrypted message.
(2) Then use asymmetric (slow) encryption to encrypt the following message and send it to me
"Hi, I just sent you a message encrypted using the BLAH symmetric cipher with key ABCDE123456."
So, you use your peer's public key to encrypt a shared secret, send the peer the encrypted secret, and then the peer decrypts the secret with his or her private key. In this way, you can use the big certificates to authenticate parties as well as use them to establish a shared secret.
This makes sense, but i have to be missing something. Why/how would DH be used here as well? I see that there are plenty of schemes like RSA2048 that have large keys, which i assume would be used in this way above, but also incorporate DH in their cipher suite:RSA_DHE, ECDHE.
What benefit does the DH component add? What can it do, now that we can establish a shared secret with the public keys in the certificates?