# Which is better when the secret is leaked, RSA or Diffie-Hellman?

I know that DH can be used for perfect forward secrecy but for the sake of this example, let's say that RSA and Diffie-Hellman are both used to establish a symmetric key that will be used for future encryption operations.

Which one is more secure or more vulnerable if the secret key was ever leaked?

• I personally prefer the names public and private key for asymmetric key pairs and secret key for symmetric keys. The reason is simple: generally you always keep the private key only at one entity. Secret keys would be present at both client and server in protocols so they're not private, but they should be kept secret; i.e. not made available to anybody else. I presume that you mean the private key in my answer. Feb 27, 2018 at 0:33
• @MaartenBodewes I interpreted the question to mean "What happens if you leak the value of a key that was exchanged with RSA/DH" rather than "What happens if you leak the private key". I guess we'll need grantedfour to clarify for us. Feb 27, 2018 at 0:36
• @EllaRose Well, the answer would be a lot more boring if that would be the case, but OK, grantedfour, please enlighten us! Feb 27, 2018 at 0:37

Neither one is secure if the private key is leaked; if the connection data is kept by and adversary then the adversary could decrypt the connection data if the private key of either DH or RSA key pair is lost.

The idea of ephemeral Diffie Hellman is that you create two new key pairs for each connection. Then you can throw away the key pair(s) after the connection has been set up and authenticated. Even if the private key is factored or otherwise retrieved then you could only attack a single connection. If the server is found by anybody then the private key would already have been destroyed, so this makes it impossible to decrypt the data when the server is found. This is what forward secrecy offers you.

RSA is not very useful when it comes to generating ephemeral key pairs. RSA key pair generation is one of the slowest algorithms that exist, and the time it takes to find two or more primes is indeterministic as well. In principle you could generate a new key pair at one side and use it to agree on a master key, just like with ephemeral Diffie-Hellman.

• I don't like the term perfect forward secrecy myself. It leads people to overestimate the security it offers. Feb 27, 2018 at 0:43
• Maybe you would like the term ‘key erasure’ instead, to be used with reference to when in the protocol the key is erased? (Consider, e.g., TLS session resumption with ephemeral DH for an example of where ‘[perfect] forward secrecy’ obscures a potential problem that ‘key erasure after the session resumption tickets are discarded’ emphasizes.) Feb 27, 2018 at 0:49
• Forward secrecy, without the perfect designation is already much better. But yes, key erasure would certainly also be a good option. It's a bit more generic but forward secrecy isn't that special so it works for me. Feb 27, 2018 at 1:26

Diffie-Hellman is better, but only when you use ephemeral DH.

• "RSA is better, but only when you use ephemeral RSA." My point being that this is not a property of Diffie-Hellman, but of ephemeral. Feb 27, 2018 at 0:15
• @yyyyyyy True. I think you know that it's not the best choice to generate ephemeral RSA key pair. So for practical use, there are RSA certificates, which means that RSA keys are reused. Therefore, DHE is better than RSA. Feb 28, 2018 at 8:47
• @9f241e21 Certificates are never ephemeral.
– forest
Feb 1, 2019 at 3:19

I think, your question makes no sense. More then asymmetric cypher I would call DH a secret exchange protocol. It's very simple. In modular arithmetic (mod p) both sites exchange A^x and A^y mod p. Where x and y are kept in secret. They are both able to calculate A^xy mod p and use it as a secret. With elliptic curves, it's same, just multiply operation is defined differently. Where is the public/secret key?

• The public key is what is communicated to the other party, i.e. $A^x$ and $A^y$. Terminology is always a bit of a tricky topic, but as you can use these as a public / private key pair for encryption / decryption within (EC)IES, and since ECDSA keys consist of exactly the same values, I think we can conclude that there is indeed a key pair, e.g. $x$ and $A^x$. May 27, 2022 at 13:45