4
$\begingroup$

Static Diffie-Hellman (cipher suites with DH in their name but neither DHE or DH_anon - requires that the server owns a certificate with a DH public key in it.

When static DH key exchange is used, the server provides a certificate containing fixed Diffie-Hellman parameters signed by the certificate authority (CA) - (ServerKeyExchange message is not used in this case).

Examples of static DH cipher suites:

TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA     
TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA
TLS_DH_DSS_WITH_AES_128_CBC_SHA      
TLS_DH_RSA_WITH_AES_128_CBC_SHA  
TLS_DH_DSS_WITH_AES_256_CBC_SHA256   
TLS_DH_RSA_WITH_AES_256_CBC_SHA256

From Diffie–Hellman key exchange Alice and Bob publicly agree to use a modulus p = 23 and base g = 5 (which is a primitive root modulo 23) where p is prime, and g is a primitive root modulo p. My question is.

Are the fixed Diffie-Hellman parameters provided in the certificate p and g ?

Improve this question
$\endgroup$
5
  • $\begingroup$ Please ask followup questions separately. Editing the question after it has gained an answer - requiring the answerer to add three answers to the existing post - is not considered good manners. And others may be better in answering those additional questions as well. $\endgroup$
    – Maarten Bodewes ♦
    Commented Jun 26, 2019 at 9:23
  • $\begingroup$ @MaartenBodewes Makes sense. Should I post them here as comments or in separate threats ? $\endgroup$
    – blabla_trace
    Commented Jun 26, 2019 at 9:38
  • 1
    $\begingroup$ Separate threads please. If they are sufficiently related (e.g. about the DH part of the protocol rather than the communication of the parameters as above) you can create a single post with related questions - as long as you do that in one go. People may be in the process of writing an answer, after all... $\endgroup$
    – Maarten Bodewes ♦
    Commented Jun 26, 2019 at 9:42
  • 1
    $\begingroup$ (you can still access your text by viewing the editing history, by the way, just click "edited" above my name to get to it) $\endgroup$
    – Maarten Bodewes ♦
    Commented Jun 26, 2019 at 9:54
  • $\begingroup$ @MaartenBodewes Thank you Creating a new threat right now :) $\endgroup$
    – blabla_trace
    Commented Jun 26, 2019 at 9:55

1 Answer 1

Reset to default
6
$\begingroup$

This has been (re-)defined in RFC 3279: "Algorithms and Identifiers for the Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile". For DH section 2.3.3: "Diffie-Hellman Key Exchange Keys" applies:

Here is the ASN.1 module (which was copied from X9.42, so this is at least a copy of a copy):

  DomainParameters ::= SEQUENCE {

        p       INTEGER, -- odd prime, p=jq +1
        g       INTEGER, -- generator, g
        q       INTEGER, -- factor of p-1
        j       INTEGER OPTIONAL, -- subgroup factor
        validationParms  ValidationParms OPTIONAL }

  ValidationParms ::= SEQUENCE {

        seed             BIT STRING,
        pgenCounter      INTEGER }

So it at least $p$, $g$ and $q$, but the co-factor $q$ is usually set to 1. This set has been defined for OID 1.2.840.10046.2.1 ("dhpublicnumber").

However, when trying this for myself using openssl command line, I only got two parameters, $p$ and $g$. Turns out openssl is using PKCS#3 instead:

  DHParameter ::= SEQUENCE {

        prime    INTEGER, -- p
        base     INTEGER, -- g
        privateValueLength INTEGER OPTIONAL }

which has been defined for OID 1.2.840.113549.1.3.1 ("dhKeyAgreement").

So yeah, $p$ and $g$ are certainly in there, which set of parameters are in there depends on the OID that defines the key type of the public key and the choices of the organization implementing it. That's a lot of options for something that is barely used.

Improve this answer
$\endgroup$
4
  • $\begingroup$ Thank you Sir! One question though. So we have the Server with its DH public key embedded in its certificate and a private key that is stored on the Server. The Server sends it pub key value in the ServerKeyExchange message but assuming the client is not using certificate authentication how does it generate its priv/pub DH key pair to be able to send its pub key value in the ClientKeyExchange message. $\endgroup$
    – blabla_trace
    Commented Jun 25, 2019 at 20:56
  • 1
    $\begingroup$ TLS uses ephemeral-static key agreement. That means that the client simply generates the public / private key pair on the fly. If client authentication is required it is performed separately - e.g. with a certificate that contains an RSA or ECDSA public key rather than a DH based certificate. The client must use the same parameters as present in the certificate to perform the key agreement, of course. $\endgroup$
    – Maarten Bodewes ♦
    Commented Jun 25, 2019 at 21:17
  • 2
    $\begingroup$ @blabla_trace: for static DH (and also static ECDH) the server pubkey and parameters are in server cert and server does not send ServerKeyExchange at all (see 7.4.3 in TLS<=1.2; 1.3 doesn't allow static (EC)DH at all), Maarten: client (<=1.2) can choose static-static if client auth was requested and it has a DH cert; see case 'implicit' in 7.4.7.2. Although premaster is the same for all sessions using a given static-static cert pair, key derivation (PRF) adds the nonces so that master and working keys differ. $\endgroup$
    – dave_thompson_085
    Commented Jun 26, 2019 at 0:42
  • 1
    $\begingroup$ On further checking I found OpenSSL library since 1.0.2 (2015-01) supports X9.42 ASN.1 under the name DHxparams vs. DHparams for PKCS3. The only commandline access I find to this is if you use dhparam -dsaparam to convert (or create and convert) from DSA format params, or genpkey -genparam -algorithm DH -pkeyopt dh_paramgen_type:{1 or 2} (only 1 is documented) to similarly create and convert from DSA format. $\endgroup$
    – dave_thompson_085
    Commented Aug 22, 2019 at 3:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.