1
$\begingroup$

I've read that the RSA algorithm is preferred over Diffie-Hellman key exchange as it makes key management easier. In the context of online banking, before the RSA algorithm they would have to maintain a different shared key with every single one of their customers, instead of just having one public key and a private key.

But then I've also read that RSA is primarily used for exchanging a shared key for use in symmetric ciphers like AES. So surely no matter if the bank were to use DH or RSA they would still establish a shared key and key management would be just as much a problem as it was before?

Improve this question
$\endgroup$
4
  • $\begingroup$ Possibly answered here: "Is there any particular reason to use Diffie-Hellman over RSA for key exchange?" security.stackexchange.com/a/35521/68088 $\endgroup$
    – vrtjason
    May 21, 2018 at 19:37
  • 1
    $\begingroup$ What are your sources? It sounds like they're vague, they're wrong, or you're misunderstanding them. If they actually say something like "before RSA" as opposed to, for example, "without asymmetric cryptography" you might want to check the publication date. $\endgroup$
    – Future Security
    May 21, 2018 at 20:06
  • $\begingroup$ Sorry I probably am wrong, and I don't have any direct sources but I was under the impression that the RSA algorithm came after Diffie-Hellman key exchange. $\endgroup$
    – Retsek
    May 22, 2018 at 22:07
  • $\begingroup$ RSA was published the year after DH. Over 40 years ago. Publication took longer prior to the modern age of the internet (papers were published ON paper), so one year's difference is smaller than you think. Also it probably is relevant that online banking didn't become a thing until the 90s. (I overlooked that before.) Key management of RSA keys and DH keys are equally difficult. $\endgroup$
    – Future Security
    May 22, 2018 at 22:38

1 Answer 1

Reset to default
3
$\begingroup$

RSA is rarely appropriate instead of DH for key exchange. It's mostly only appropriate if backwards-compatibility is required, or if keys need to be sent from one party to the other instead of generated for each session (eg for encrypting e-mail).

RSA is much, much harder to use securely. RSA requires padding of the messages, which is quite easy to screw up in ways that catastrophically break the security of the system. RSA is far more expensive to use in an ephemeral mode, and thus typically cannot provide forward secrecy. RSA keys are substantially larger than ECDH (Elliptic Curve Diffie-Hellman) keys. RSA key generation is much more complex (and harder to get right) than (some) ECDH key generation: RSA needs to generate large prime numbers & ensure that they are safe, while X25519 or X448 ECDH systems can use any random number of the appropriate length.

Where possible use ECDHE (Elliptic Curve Diffie-Hellman, Ephemeral). If you can't do that, use DHE. If you can't do that, use ECDH. If you can't do that, use DH. If you can't do that, THEN use RSA.

RSA can also be used as part of a signature scheme, but that's not relevant to this question since it's not comparable to DH which only does key exchange. TLS 1.3 uses RSA only for signing the DHE or ECDHE key exchange, and also supports ECDSA for signing.

NaCL, Libsodium, Libhydrogen, TLS 1.3, monocypher, and probably a few other libraries and cryptographic standards have dropped the use of RSA for key exchange.

Improve this answer
$\endgroup$
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.