ECDH-RSA is used for key exchange, this is what happens:
The server has its public
ECDH parameter embedded within its certificate. The client generates its public
ECDH parameter, extracts the server's public
ECDH parameter and generates the shared
ECDH secret. This secret is then used as the premaster secret.
RSA key exchange is used, this is what happens:
The server has its public key embedded within its certificate. The client generates the premaster secret, encrypts it with the server's public key and sends it to the server.
None of the ciphersuites offer Perfect Forward Secrecy, so what is the advantage of using an
ECDH-RSA-based ciphersuite over an
I did some evaluations, using 2048-bit RSA keys and 256-bit ECDH key. In the table below, I present the number of CPU instructions (in millions) used by the client and the server to perform the key exchange with each algorithm:
+--------+------+----------+ | | RSA | ECDH-RSA | +--------+------+----------+ | Client | 4.5 | 54.5 | | Server | 75.5 | 27.5 | +--------+------+----------+
This means that in an
RSA key exchange, the client uses 4.5 million CPU instructions, while the server uses 75.5 million CPU instructions. Similarly, in an
ECDH-RSA key exchange, the client uses 54.5 million CPU instructions, while the server uses 27.5 million CPU instructions.
If we raise the security level to 7680-bit RSA keys and 409-bit ECDH keys, we obtain the following results:
+--------+------+----------+ | | RSA | ECDH-RSA | +--------+------+----------+ | Client | 15.5 | 89.5 | | Server | 1503 | 44.5 | +--------+------+----------+
RSA, the server-side cost raise abruptly. This can be explained by the fact that the server will use a very large private RSA key to decrypt the premaster secret. Note how now the server uses 1503 million (i.e. 1.5 billion) CPU cycles to perform an
RSA key exchange.
Since no extra security is offered when
ECDH-RSA is used, the main advantages that I could find are cost-related and do not benefit both parties:
Total cost is a lot smaller when the security level is raised.
Helps to "even the costs out", to minimize the resource usage differences between the peers.
There is a smaller increase in total costs as the security level increases. This brings advantages to the server (specially for higher security levels).
The client is, however, always in a cost disadvantage when
ECDH-RSA key exchange is used instead of
RSA. Assuming that I'm a selfish user browsing the web, wouldn't it make more sense for me to always prefer the
RSA key exchange?