Do cipher suites that use static Diffie Hellman (not Ephemeral) allow for the same 3rd party decryption ability as RSA cipher suites?

With RSA key exchange, 3rd parties can gain possession of the plaintext random numbers that flowed in the Client and Server Hello records.

If also in possession of the server's private RSA key, they can decrypt the pre-master secret in the Client Key Exchange, and therefore derive the same master secret and symmetric keys as the client and server.

Building on this question and the general Wireshark documents around DH, I am wondering if static DH allows for the same sequence of 3rd party decryption as RSA?

Is it only the DHE key exchanges that block 3rd parties from performing the above steps, thanks to there being no long-lived key to share with them?

Existing questions and documentation only seem to concern Ephemeral rather than Static DH.

  • $\begingroup$ Note that Static RSA and Diffie-Hellman cipher suites have been removed from TLS 1.3. $\endgroup$
    – kelalaka
    Feb 5 '20 at 19:10

I am wondering if static DH allows for the same sequence of 3rd party decryption as RSA?

Yes, if a third party learns the server's (or the client's) DH private value, they can recover the DH shared secret, and thus recover the premaster secret, the master secret and thus the traffic keys.

This is true for both static and ephemeral DH. Of course, with ephemeral DH, both sides are supposed to discard their private values immediately after using it (and thus the window of opportunity for the attacker is less). With static DH, this is obviously not possible (as the server will use the same DH private value for the next negotiation).

  • $\begingroup$ Great answer, thanks. Might be outside of scope but do typical web servers that could use static DH store the private DH value as a key file, again much like RSA? In other words, how is that private DH value stored? $\endgroup$ Feb 5 '20 at 18:51
  • $\begingroup$ @NealEastwood: I believe static DH is designed for when you have a DH certificate; that is, a certificate that lists a DH public value (and the server keeps its DH private value in the same way it would keep a RSA private key). In my experience, DH certificates are very rare (if used at all) $\endgroup$
    – poncho
    Feb 5 '20 at 19:02
  • 1
    $\begingroup$ @Neal: I can't prove typical, but all apache, ngnix and haproxy servers and at least many Tomcat (Wildfly etc) servers and some others like nodejs use OpenSSL, and OpenSSL did not support static-DH ciphersuites until 1.0.2 in 2015, and the next release, 1.1.0 in 2016, rewrote all protocol logic and dropped them, along with static-ECDH which was implemented since 1.0.0 in 2010 and experimentally earlier in 0.9.8. And I'm pretty sure no version of Windows, and thus IIS, ever implemented either static-DH or static-ECDH. $\endgroup$ Feb 6 '20 at 3:31
  • $\begingroup$ Very interesting and good to know - thanks. TLS 1.2 is my primary interest, and good to know static-DH is not really used/supported in the wild. $\endgroup$ Feb 6 '20 at 11:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.