I understand that Perfect Forward secrecy is meant to prevent the data sent between the client and server being decrypted in case the private key is leaked some time after the data being sent.
But why do we need something complicated like Diffie-Hellman key exchange to do this? Couldn't we simply use XOR instead, like this:
- The client generates a random encryption key, K and a random number of the same length, R1
- The client sends K xor R1 to the server
- The server generates a random number R2
- The server sends K xor R1 xor R2 to the client
- The client xors the message with its random number, sending K xor R2 to the server
- The server xors the message with its random number too, which results in the key, K, which is then used to encrypt all communications
If a key that isn't generated by only the client/server is needed for some reason, then this process can be repeated again by the server and then the two keys can be xored to get the final key.
Unless the SSL private key is known when this exchange happens, which would allow for a man-in-the-middle to modify messages sent between the client and server, no one will be able to figure out what the key is.
I understand that XOR is vulnerable to known-plaintext attacks, but since both the random numbers and the encryption key are used only once, I don't see why this should matter.