Why aren't Diffie Hellman public keys used for authentication?

Question

So I have been reading about Diffie Hellman and specifically the MitM attacks that it is vulnerable to.

I am aware that these are solved currently in ssl for instance by using rsa signatures to authenticate dh public keys (as in the $g^a$ mod n bit) to prevent a middle man from compromising the connection.

I also am aware that the public key of the server that is used in the RSA authentication is provided by a CA which is how the browser knows it is valid.

I am also aware that DH as used in ssl is ECDH, but regardless I think my question still applies and I would be interested in an answer in reference to either ECDH or just normal DH.

What I don't understand however is why the certification authority (CA) can't simply give out the servers $g^a$ mod n (public DH key) instead of their public RSA key, as to avoid having to use RSA.

I know that one reason this is not used is because of forward secrecy which can only be gained with session based DH keys, but why has this never been implemented (from what I can tell, it hasn't) even though non forward secret RSA used to be used for this purpose?

Would having a persistent DH public key introduce a mathematical vulnerability or is there another reason why this hasn't been done?

Thanks you

Answer 1

This is called static DH. It can be done directly by using OpenSSL, but not many clients will support it. There is no mathematical vulnerability to using DH in this way, but it never really took off. Infrastructure for RSA signatures were already in place, so there was no need to switch to another algorithm.