If ECDH-RSA is used for key exchange, this is what happens:

The server has its public ECDH parameter embedded within its certificate. The client generates its public ECDH parameter, extracts the server's public ECDH parameter and generates the shared ECDH secret. This secret is then used as the premaster secret.

If RSA key exchange is used, this is what happens:

The server has its public key embedded within its certificate. The client generates the premaster secret, encrypts it with the server's public key and sends it to the server.

None of the ciphersuites offer Perfect Forward Secrecy, so what is the advantage of using an ECDH-RSA-based ciphersuite over an RSA one?

I did some evaluations, using 2048-bit RSA keys and 256-bit ECDH key. In the table below, I present the number of CPU instructions (in millions) used by the client and the server to perform the key exchange with each algorithm:

|        | RSA  | ECDH-RSA |
| Client |  4.5 |     54.5 |
| Server | 75.5 |     27.5 |

This means that in an RSA key exchange, the client uses 4.5 million CPU instructions, while the server uses 75.5 million CPU instructions. Similarly, in an ECDH-RSA key exchange, the client uses 54.5 million CPU instructions, while the server uses 27.5 million CPU instructions.

If we raise the security level to 7680-bit RSA keys and 409-bit ECDH keys, we obtain the following results:

|        | RSA  | ECDH-RSA |
| Client | 15.5 |     89.5 |
| Server | 1503 |     44.5 |

In RSA, the server-side cost raise abruptly. This can be explained by the fact that the server will use a very large private RSA key to decrypt the premaster secret. Note how now the server uses 1503 million (i.e. 1.5 billion) CPU cycles to perform an RSA key exchange.

Since no extra security is offered when ECDH-RSA is used, the main advantages that I could find are cost-related and do not benefit both parties:

  • Total cost is a lot smaller when the security level is raised.

  • Helps to "even the costs out", to minimize the resource usage differences between the peers.

  • There is a smaller increase in total costs as the security level increases. This brings advantages to the server (specially for higher security levels).

The client is, however, always in a cost disadvantage when ECDH-RSA key exchange is used instead of RSA. Assuming that I'm a selfish user browsing the web, wouldn't it make more sense for me to always prefer the RSA key exchange?

  • A few million extra cycles isn't going to impact your browsing experience. – forest Sep 4 '18 at 19:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.