I read that D-H is used to make a shared secret between parties that then they use to encrypt the messages.

This is used in TLS, for example, after the server has authenticated itself with a certificate.

But, if I understand correctly, the certificate has server's public key to use for encryption. Why not just encrypt the secret (or symmetric key) with that public key and send that to the server?

EDIT AFTER MARKED AS DUPLICATE: The marked duplicate question Is there any particular reason to use Diffie-Hellman over RSA for key exchange? is asking why prefer DH over RSA (ephemeral DH and ephemeral RSA I think?) for symmetric key exchange. I'm asking why use any of them at all (DH, or ephemeral RSA), why doesn't client just send the symmetric key encrypted with server's certificate public key? Reading the marked duplicate, and https://crypto.stackexchange.com/questions/29744/can-an-ephemeral-rsa-key-give-forward-secrecy I came to the conclusion that my proposal can be used for symmetric key exchange in TLS-like protocol if we do not care about PFS (perfect forward secrecy), and the reason for using ephemeral DH or ephemeral RSA as additional step is only to achieve PFS. Am I correct?

  • I agree with Androl that it sounds like a duplicate. I also voted to close this question in favor of the other one. It's a good question, though! If you do not think it is a duplicate, please edit your question to clarify the difference.
    – Luc
    Nov 2, 2018 at 22:37
  • OK, so if I understand correctly both ways from my title can be used after receiving the server's certificate (at least in older SSL protocols), with the latter method from my title (called RSA in the other question) not providing PFS? What confuses me is that the other answer says this RSA (ephemeral RSA) provides PFS. Is RSA from the other question really the same as just having the client return the secret RSA encrypted with certificates public key?
    – croraf
    Nov 3, 2018 at 7:25
  • Actually I think the question is not a duplicate (although the answer on the other one is really comprehensive and helped me a lot). The other question is asking DH vs ephemeral RSA. So this is the step after receiving certificate. I was asking why make this extra step and not just return the symmetric key immediately by the client. The reason is PFS. This question also clarified me crypto.stackexchange.com/questions/29744/…. Can you confirm?
    – croraf
    Nov 3, 2018 at 7:36
  • 2
    Thanks. The provided duplicate answer and the link from crypto.SE helped me to get to the conclusion if I'm correct. Unfortunately I cannot answer here as it is marked duplicate (although atm I think it's a separate question as explained above), so I have to wait for admin to reassess.
    – croraf
    Nov 3, 2018 at 13:03
  • 2
    @croraf: In RSA Kx as done in TLS the client generates the premaster secret and encrypts it with the servers public key taken from the certificate. Then client and server derive the master secret and keys from this premaster secret and some other stuff (client and server random). While a bit more complex than what you propose it is essentially what you propose. There are no ephemeral RSA keys involved in this. Nov 4, 2018 at 8:57