# Static Diffie-Hellman in TLS

Static Diffie-Hellman (cipher suites with DH in their name but neither DHE or DH_anon - requires that the server owns a certificate with a DH public key in it.

When static DH key exchange is used, the server provides a certificate containing fixed Diffie-Hellman parameters signed by the certificate authority (CA) - (ServerKeyExchange message is not used in this case).

Examples of static DH cipher suites:

TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA
TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA
TLS_DH_DSS_WITH_AES_128_CBC_SHA
TLS_DH_RSA_WITH_AES_128_CBC_SHA
TLS_DH_DSS_WITH_AES_256_CBC_SHA256
TLS_DH_RSA_WITH_AES_256_CBC_SHA256


From Diffie–Hellman key exchange Alice and Bob publicly agree to use a modulus p = 23 and base g = 5 (which is a primitive root modulo 23) where p is prime, and g is a primitive root modulo p. My question is.

Are the fixed Diffie-Hellman parameters provided in the certificate p and g ?

• Please ask followup questions separately. Editing the question after it has gained an answer - requiring the answerer to add three answers to the existing post - is not considered good manners. And others may be better in answering those additional questions as well. – Maarten Bodewes Jun 26 '19 at 9:23
• @MaartenBodewes Makes sense. Should I post them here as comments or in separate threats ? – blabla_trace Jun 26 '19 at 9:38
• Separate threads please. If they are sufficiently related (e.g. about the DH part of the protocol rather than the communication of the parameters as above) you can create a single post with related questions - as long as you do that in one go. People may be in the process of writing an answer, after all... – Maarten Bodewes Jun 26 '19 at 9:42
• (you can still access your text by viewing the editing history, by the way, just click "edited" above my name to get to it) – Maarten Bodewes Jun 26 '19 at 9:54
• @MaartenBodewes Thank you Creating a new threat right now :) – blabla_trace Jun 26 '19 at 9:55

This has been (re-)defined in RFC 3279: "Algorithms and Identifiers for the Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile". For DH section 2.3.3: "Diffie-Hellman Key Exchange Keys" applies:

Here is the ASN.1 module (which was copied from X9.42, so this is at least a copy of a copy):

  DomainParameters ::= SEQUENCE {
p       INTEGER, -- odd prime, p=jq +1
g       INTEGER, -- generator, g
q       INTEGER, -- factor of p-1
j       INTEGER OPTIONAL, -- subgroup factor
validationParms  ValidationParms OPTIONAL }

ValidationParms ::= SEQUENCE {
seed             BIT STRING,
pgenCounter      INTEGER }


So it at least $$p$$, $$g$$ and $$q$$, but the co-factor $$q$$ is usually set to 1. This set has been defined for OID 1.2.840.10046.2.1 ("dhpublicnumber").

However, when trying this for myself using openssl command line, I only got two parameters, $$p$$ and $$g$$. Turns out openssl is using PKCS#3 instead:

  DHParameter ::= SEQUENCE {
prime    INTEGER, -- p
base     INTEGER, -- g
privateValueLength INTEGER OPTIONAL }


which has been defined for OID 1.2.840.113549.1.3.1 ("dhKeyAgreement").

So yeah, $$p$$ and $$g$$ are certainly in there, which set of parameters are in there depends on the OID that defines the key type of the public key and the choices of the organization implementing it. That's a lot of options for something that is barely used.

• Thank you Sir! One question though. So we have the Server with its DH public key embedded in its certificate and a private key that is stored on the Server. The Server sends it pub key value in the ServerKeyExchange message but assuming the client is not using certificate authentication how does it generate its priv/pub DH key pair to be able to send its pub key value in the ClientKeyExchange message. – blabla_trace Jun 25 '19 at 20:56
• TLS uses ephemeral-static key agreement. That means that the client simply generates the public / private key pair on the fly. If client authentication is required it is performed separately - e.g. with a certificate that contains an RSA or ECDSA public key rather than a DH based certificate. The client must use the same parameters as present in the certificate to perform the key agreement, of course. – Maarten Bodewes Jun 25 '19 at 21:17
• @blabla_trace: for static DH (and also static ECDH) the server pubkey and parameters are in server cert and server does not send ServerKeyExchange at all (see 7.4.3 in TLS<=1.2; 1.3 doesn't allow static (EC)DH at all), Maarten: client (<=1.2) can choose static-static if client auth was requested and it has a DH cert; see case 'implicit' in 7.4.7.2. Although premaster is the same for all sessions using a given static-static cert pair, key derivation (PRF) adds the nonces so that master and working keys differ. – dave_thompson_085 Jun 26 '19 at 0:42
• On further checking I found OpenSSL library since 1.0.2 (2015-01) supports X9.42 ASN.1 under the name DHxparams vs. DHparams for PKCS3. The only commandline access I find to this is if you use dhparam -dsaparam to convert (or create and convert) from DSA format params, or genpkey -genparam -algorithm DH -pkeyopt dh_paramgen_type:{1 or 2} (only 1 is documented) to similarly create and convert from DSA format. – dave_thompson_085 Aug 22 '19 at 3:33