What is ECDHE-RSA?

Question

What is the difference between ECDHE-RSA and DHE-RSA?

I know that DHE-RSA is (in one sentence) Diffie Hellman signed using RSA keys. Where DH is used for forward secrecy and RSA guards against MITM, but where do the elliptic curves in ECDHE-RSA are exactly used? What upsides has ECDHE-RSA over DHE-RSA?

Answer 1

ECDHE suites use elliptic curve diffie-hellman key exchange, where DHE suites use normal diffie-hellman. This exchange is signed with RSA, in the same way in both cases.

The main advantage of ECDHE is that it is significantly faster than DHE. This blog article talks a bit about the performance of ECDHE vs. DHE in the context of SSL.

Answer 2

To add a bit of information on what @CodesInChaos says:

When you use ECDHE instead of DHE, you may obtain the following advantages:

• Better performance. ECDHE is faster, for a given security level; @CodesInChaos points to an article which gives figures; see also this answer for why elliptic curve offer better performance.
• Smaller messages. An ECDH public key, with a 224-bit curve, will be encoded over 56 bytes, whereas a classical DH public key of similar strength must use a 2048-bit modulus and will use 256 bytes. Since there are two such message in a SSL handshake, ECDHE saves you about 400 bytes. That's not a lot, but it can make a difference in some contexts.
• Biodiversity. ECDH relies on the hardness of a mathematical problem which is distinct from the one used for classical DH. To some extent, classical DH can be viewed as a very specific sub-case of ECDH (computations modulo a prime are isomorphic to curve point addition in an anomalous curve) so we can handwave an argument about how ECDH is inherently at least as strong as DH (if ECDH is broken, so is DH). In practice, there are sub-exponential (i.e. faster) algorithms for solving discrete logarithm, which is why we must use a 2048-bit modulus instead of a 224-bit modulus for plain DH; while no such "faster" algorithm is known to break the elliptic-curve variant.
• Fashionability. Elliptic curves are cool. This is an important advantage, although it is customarily expressed with a more serious-looking and boring terminology ("compliance", "Approved algorithm"...).
• Cleansing. If you enforce ECDHE usage, you will automatically reject old implementations which do not know how to do ECDHE. If you use ECDHE for your Web server, you no longer have to worry about IE 6.0 or 7.0 ! The cryptographic arguments for ECDHE are a good excuse to kill off such dinosaurs which should have fossilized away long ago.