Why Static RSA and Diffie-Hellman cipher suites have been removed in TLS 1.3?

How keys can be exchanged then?



TLS 1.3 has a huge clean up as having 5 cipher suites. As stated in the document

Static RSA and Diffie-Hellman cipher suites have been removed; all public-key based key exchange mechanisms now provide forward secrecy.

With forward secrecy (also called PFS for Perfect Forward Secrecy), even if one of the site's key is compromised, the previously generated keys are safe since there is no method that can regenerate them. The keys are called ephemeral keys.

You can still use ECDH for key establishment but not statically.

There is one drawback, that is; even if you use FPS, one side still can be store the previous keys. That is not recommended and you cannot be sure about the other side.

  • $\begingroup$ To answer the specific question of how keys are exchanged in ephemeral key exchange, the public parameters for the key exchange algorithm (temporary asymmetric key) is usually signed by or otherwise authenticated with the long term static keypair. Both parties make up random one use keys and send the public parts, the server signs theirs public part, and the one use keys are used to derive a one use symmetric session key. $\endgroup$ – Natanael Feb 25 at 21:32
  • 1
    $\begingroup$ Note as well that DH leaf certificates are hardly ever used, and that RSA suites require the key to be used in encryption mode, rather than for just authentication (signature generation) which is usually its main purpose. So there are some more practical reasons to remove the suites as well. $\endgroup$ – Maarten Bodewes Feb 25 at 23:33
  • $\begingroup$ "There is one drawback, that is, one side maybe stores the previous keys. That is not recommended and you cannot be sure about the other side." Do you mean the keys are not stored for static DH? $\endgroup$ – Shan Chen Feb 26 at 1:59
  • $\begingroup$ @ShanChen some servers reuse DHE / ECDHE session keys / parameters among multiple connections, only replacing and clearing them occasionally. Sometimes lasting 24h or more $\endgroup$ – Natanael Feb 26 at 2:38
  • 1
    $\begingroup$ @ShanChen Maybe I did not use the correct words. Even if you use FPS, you cannot prevent the other side not to store the keys. $\endgroup$ – kelalaka Feb 26 at 10:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.