1
$\begingroup$

Since the basic version of Diffie-Hellman key exchange protocol is vulnerable to Man In The Middle Attack, some sort of authentication is needed. It was mentioned that RSA digital signature can be used to handle this case. However, I don't understand that if the public keys of the two parties are known to each other, what would be the point of using DH at all? One of them can just propose a shared key k, compute its hash value and send the (k, h(k)) encrypted with the other one's public key. I appreciate if anyone can clarify the benefit of using DH in case of known public keys.

Improve this question
$\endgroup$
1
  • $\begingroup$ I actually found a really good answer here, explaining Meir's answer further. $\endgroup$
    – Farzad Vertigo
    Sep 15, 2018 at 10:05

2 Answers 2

Reset to default
3
$\begingroup$

Diffie-Hellman allows for forward secrecy. In the protocol you describe, if the private key is ever leaked all previously exchanged keys are leaked.

If we only use RSA to authenticate keys created with Diffie-Hellman, past keys are safe even if you lose control over your private key in the future.

Improve this answer
$\endgroup$
1
$\begingroup$

However, I don't understand that if the public keys of the two parties are known to each other, what would be the point of using DH at all? One of them can just propose a shared key k, compute its hash value and send the (k, h(k)) encrypted with the other one's public key.

Actually, this is not how Diffie-Hellman works at all.

Diffie-Hellman is not a public-key encryption scheme. It is a key agreement scheme.

The difference being that with key agreement, neither Alice nor Bob has any say in what the resultant shared secret ends up being. They both arrive at a mutually shared secret, but it is not selected explicitly by either of them.

With public-key encryption being used for key exchange, then yes, one of them could pick a random $k$, encrypt the result, then send it to the other party.

I appreciate if anyone can clarify the benefit of using DH in case of known public keys.

Benefits include:

  • Smaller parameters, which implies faster processing
    • Especially so for Elliptic Curve Diffie-Hellman
  • If the public keys are both known already, then computing the shared secret requires no network traffic
  • No/less concern about the shared secret being of low quality
    • If Alice sends $k$ to Bob, and Alices machine has insufficient entropy and/or a poor quality random number generator, then $k$ can be guessed by an adversary
    • If both DH private keys are sufficiently strong, then the shared secret should be so as well
Improve this answer
$\endgroup$
3
  • $\begingroup$ This probably reiterates some of the content from the linked security.stackexchange answer. Also, the list of benefits may not be exhaustive. $\endgroup$
    – Ella Rose
    Sep 15, 2018 at 15:39
  • $\begingroup$ I read the question as: if RSA keys are used to authenticate the session key, why use DH at all? $\endgroup$
    – Meir Maor
    Sep 15, 2018 at 17:20
  • $\begingroup$ @MeirMaor I quoted the part of the question that I answered, namely One of them can just propose a shared key k, compute its hash value and send the (k, h(k)) encrypted with the other one's public key.. This was not my interpretation, it is explicitly stated as such in the body of the question. $\endgroup$
    – Ella Rose
    Sep 15, 2018 at 17:21

Not the answer you're looking for? Browse other questions tagged or ask your own question.