Why Static RSA and Diffie-Hellman cipher suites have been removed in TLS 1.3?
How keys can be exchanged then?
https://datatracker.ietf.org/doc/html/draft-ietf-tls-tls13-28
$\begingroup$
$\endgroup$
0
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
9
TLS 1.3 has a huge clean up as having 5 cipher suites. As stated in the RFC document RFC 8446 section 1.2 :
Static RSA and Diffie-Hellman cipher suites have been removed; all public-key based key exchange mechanisms now provide forward secrecy.
With forward secrecy (also called PFS for Perfect Forward Secrecy), even if one of the site's key is compromised, the previously generated keys are safe since there is no method that can regenerate them. The keys are called ephemeral keys.
You can still use ECDH in TLS 1.3 for key establishment but not statically. This version also named ECDHE where the last E is Ephemeral.
There is one drawback, that is; even if you use FPS, the other side can not only store the keys but can also store all the decrypted messages. You don't/can't know that. Storing is not recommended but you cannot prevent that.
When one side stores the keys, it is the opposite of the forward secrecy. Once the attackers breached into the site that will access all the stored keys, but the system was perfect secrecy! Actually, the keys must be erased after the decryption.
See also, misuse of forward-secrecy on Squeamish Ossifrage's answer.
answered Feb 25, 2019 at 18:15
-
$\begingroup$ To answer the specific question of how keys are exchanged in ephemeral key exchange, the public parameters for the key exchange algorithm (temporary asymmetric key) is usually signed by or otherwise authenticated with the long term static keypair. Both parties make up random one use keys and send the public parts, the server signs theirs public part, and the one use keys are used to derive a one use symmetric session key. $\endgroup$– NatanaelCommented Feb 25, 2019 at 21:32
-
1$\begingroup$ Note as well that DH leaf certificates are hardly ever used, and that RSA suites require the key to be used in encryption mode, rather than for just authentication (signature generation) which is usually its main purpose. So there are some more practical reasons to remove the suites as well. $\endgroup$– Maarten Bodewes ♦Commented Feb 25, 2019 at 23:33
-
$\begingroup$ "There is one drawback, that is, one side maybe stores the previous keys. That is not recommended and you cannot be sure about the other side." Do you mean the keys are not stored for static DH? $\endgroup$ Commented Feb 26, 2019 at 1:59
-
1$\begingroup$ @ShanChen Maybe I did not use the correct words. Even if you use FPS, you cannot prevent the other side not to store the keys. $\endgroup$– kelalakaCommented Feb 26, 2019 at 10:42
-
1$\begingroup$ @kelalaka: "you cannot be sure about the other side" - Why don't you say more? The other side can not only store the keys, but can also store all the decrypted messages. You don't know that. You cannot prevent that. $\endgroup$ Commented Sep 4, 2019 at 21:29