2
$\begingroup$

I know that DH can be used for perfect forward secrecy but for the sake of this example, let's say that RSA and Diffie-Hellman are both used to establish a symmetric key that will be used for future encryptions.

Which one is more secure or more vulnerable if the secret key was ever leaked?

|improve this question
$\endgroup$
  • 1
    $\begingroup$ I personally prefer the names public and private key for asymmetric key pairs and secret key for symmetric keys. The reason is simple: generally you always keep the private key only at one entity. Secret keys would be present at both client and server in protocols so they're not private, but they should be kept secret; i.e. not made available to anybody else. I presume that you mean the private key in my answer. $\endgroup$ – Maarten Bodewes♦ Feb 27 '18 at 0:33
  • 1
    $\begingroup$ @MaartenBodewes I interpreted the question to mean "What happens if you leak the value of a key that was exchanged with RSA/DH" rather than "What happens if you leak the private key". I guess we'll need grantedfour to clarify for us. $\endgroup$ – Ella Rose♦ Feb 27 '18 at 0:36
  • $\begingroup$ @EllaRose Well, the answer would be a lot more boring if that would be the case, but OK, grantedfour, please enlighten us! $\endgroup$ – Maarten Bodewes♦ Feb 27 '18 at 0:37
2
$\begingroup$

Neither one is secure if the private key is leaked; if the connection data is kept by and adversary then the adversary could decrypt the connection data if the private key of either DH or RSA key pair is lost.

The idea of ephemeral Diffie Hellman is that you create two new key pairs for each connection. Then you can throw away the key pair(s) after the connection has been set up and authenticated. Even if the private key is factored or otherwise retrieved then you could only attack a single connection. If the server is found by anybody then the private key would already have been destroyed, so this makes it impossible to decrypt the data when the server is found. This is what forward secrecy offers you.

RSA is not very useful when it comes to generating ephemeral key pairs. RSA key pair generation is one of the slowest algorithms that exist, and the time it takes to find two or more primes is indeterministic as well. In principle you could generate a new key pair at one side and use it to agree on a master key, just like with ephemeral Diffie-Hellman.

|improve this answer
$\endgroup$
  • $\begingroup$ I don't like the term perfect forward secrecy myself. It leads people to overestimate the security it offers. $\endgroup$ – Maarten Bodewes♦ Feb 27 '18 at 0:43
  • $\begingroup$ Maybe you would like the term ‘key erasure’ instead, to be used with reference to when in the protocol the key is erased? (Consider, e.g., TLS session resumption with ephemeral DH for an example of where ‘[perfect] forward secrecy’ obscures a potential problem that ‘key erasure after the session resumption tickets are discarded’ emphasizes.) $\endgroup$ – Squeamish Ossifrage Feb 27 '18 at 0:49
  • $\begingroup$ Forward secrecy, without the perfect designation is already much better. But yes, key erasure would certainly also be a good option. It's a bit more generic but forward secrecy isn't that special so it works for me. $\endgroup$ – Maarten Bodewes♦ Feb 27 '18 at 1:26
1
$\begingroup$

Diffie-Hellman is better, but only when you use ephemeral DH.

|improve this answer
$\endgroup$
  • 5
    $\begingroup$ "RSA is better, but only when you use ephemeral RSA." My point being that this is not a property of Diffie-Hellman, but of ephemeral. $\endgroup$ – yyyyyyy Feb 27 '18 at 0:15
  • $\begingroup$ @yyyyyyy True. I think you know that it's not the best choice to generate ephemeral RSA key pair. So for practical use, there are RSA certificates, which means that RSA keys are reused. Therefore, DHE is better than RSA. $\endgroup$ – 9f241e21 Feb 28 '18 at 8:47
  • $\begingroup$ @9f241e21 Certificates are never ephemeral. $\endgroup$ – forest Feb 1 at 3:19
0
$\begingroup$

I think, your question makes no sense. More then asymetric cypher I would call DH a secret exchange protocol. It's very simple. In modular arithmetic (mod p) both sites exchange A^x and A^y mod p. Where x and y are kept in secret. They are both able to calculate A^xy mod p and use it as a secret. With eliptic curves, it's same, just multiply operation is defined differently. Where is the public/secret key?

|improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.