1
$\begingroup$

This question already has an answer here:

Since the basic version of Diffie-Hellman key exchange protocol is vulnerable to Man In The Middle Attack, some sort of authentication is needed. It was mentioned that RSA digital signature can be used to handle this case. However, I don't understand that if the public keys of the two parties are known to each other, what would be the point of using DH at all? One of them can just propose a shared key k, compute its hash value and send the (k, h(k)) encrypted with the other one's public key. I appreciate if anyone can clarify the benefit of using DH in case of known public keys.

$\endgroup$

marked as duplicate by Maarten Bodewes, otus, e-sushi Sep 23 '18 at 4:30

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • $\begingroup$ I actually found a really good answer here, explaining Meir's answer further. $\endgroup$ – Farzad Vertigo Sep 15 '18 at 10:05
3
$\begingroup$

Diffie-Hellman allows for forward secrecy. In the protocol you describe, if the private key is ever leaked all previously exchanged keys are leaked.

If we only use RSA to authenticate keys created with Diffie-Hellman, past keys are safe even if you lose control over your private key in the future.

$\endgroup$
1
$\begingroup$

However, I don't understand that if the public keys of the two parties are known to each other, what would be the point of using DH at all? One of them can just propose a shared key k, compute its hash value and send the (k, h(k)) encrypted with the other one's public key.

Actually, this is not how Diffie-Hellman works at all.

Diffie-Hellman is not a public-key encryption scheme. It is a key agreement scheme.

The difference being that with key agreement, neither Alice nor Bob has any say in what the resultant shared secret ends up being. They both arrive at a mutually shared secret, but it is not selected explicitly by either of them.

With public-key encryption being used for key exchange, then yes, one of them could pick a random $k$, encrypt the result, then send it to the other party.

I appreciate if anyone can clarify the benefit of using DH in case of known public keys.

Benefits include:

  • Smaller parameters, which implies faster processing
    • Especially so for Elliptic Curve Diffie-Hellman
  • If the public keys are both known already, then computing the shared secret requires no network traffic
  • No/less concern about the shared secret being of low quality
    • If Alice sends $k$ to Bob, and Alices machine has insufficient entropy and/or a poor quality random number generator, then $k$ can be guessed by an adversary
    • If both DH private keys are sufficiently strong, then the shared secret should be so as well
$\endgroup$
  • $\begingroup$ This probably reiterates some of the content from the linked security.stackexchange answer. Also, the list of benefits may not be exhaustive. $\endgroup$ – Ella Rose Sep 15 '18 at 15:39
  • $\begingroup$ I read the question as: if RSA keys are used to authenticate the session key, why use DH at all? $\endgroup$ – Meir Maor Sep 15 '18 at 17:20
  • $\begingroup$ @MeirMaor I quoted the part of the question that I answered, namely One of them can just propose a shared key k, compute its hash value and send the (k, h(k)) encrypted with the other one's public key.. This was not my interpretation, it is explicitly stated as such in the body of the question. $\endgroup$ – Ella Rose Sep 15 '18 at 17:21

Not the answer you're looking for? Browse other questions tagged or ask your own question.