This question already has an answer here:

I read that D-H is used to make a shared secret between parties that then they use to encrypt the messages.

This is used in TLS, for example, after the server has authenticated itself with a certificate.

But, if I understand correctly, the certificate has server's public key to use for encryption. Why not just encrypt the secret (or symmetric key) with that public key and send that to the server?

EDIT AFTER MARKED AS DUPLICATE: The marked duplicate question Is there any particular reason to use Diffie-Hellman over RSA for key exchange? is asking why prefer DH over RSA (ephemeral DH and ephemeral RSA I think?) for symmetric key exchange. I'm asking why use any of them at all (DH, or ephemeral RSA), why doesn't client just send the symmetric key encrypted with server's certificate public key? Reading the marked duplicate, and https://crypto.stackexchange.com/questions/29744/can-an-ephemeral-rsa-key-give-forward-secrecy I came to the conclusion that my proposal can be used for symmetric key exchange in TLS-like protocol if we do not care about PFS (perfect forward secrecy), and the reason for using ephemeral DH or ephemeral RSA as additional step is only to achieve PFS. Am I correct?

marked as duplicate by AndrolGenhald, Luc, nbering, Steffen Ullrich tls Nov 3 '18 at 3:33

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • I agree with Androl that it sounds like a duplicate. I also voted to close this question in favor of the other one. It's a good question, though! If you do not think it is a duplicate, please edit your question to clarify the difference. – Luc Nov 2 '18 at 22:37
  • OK, so if I understand correctly both ways from my title can be used after receiving the server's certificate (at least in older SSL protocols), with the latter method from my title (called RSA in the other question) not providing PFS? What confuses me is that the other answer says this RSA (ephemeral RSA) provides PFS. Is RSA from the other question really the same as just having the client return the secret RSA encrypted with certificates public key? – croraf Nov 3 '18 at 7:25
  • Actually I think the question is not a duplicate (although the answer on the other one is really comprehensive and helped me a lot). The other question is asking DH vs ephemeral RSA. So this is the step after receiving certificate. I was asking why make this extra step and not just return the symmetric key immediately by the client. The reason is PFS. This question also clarified me crypto.stackexchange.com/questions/29744/…. Can you confirm? – croraf Nov 3 '18 at 7:36
  • 2
    Thanks. The provided duplicate answer and the link from crypto.SE helped me to get to the conclusion if I'm correct. Unfortunately I cannot answer here as it is marked duplicate (although atm I think it's a separate question as explained above), so I have to wait for admin to reassess. – croraf Nov 3 '18 at 13:03
  • 2
    @croraf: In RSA Kx as done in TLS the client generates the premaster secret and encrypts it with the servers public key taken from the certificate. Then client and server derive the master secret and keys from this premaster secret and some other stuff (client and server random). While a bit more complex than what you propose it is essentially what you propose. There are no ephemeral RSA keys involved in this. – Steffen Ullrich Nov 4 '18 at 8:57