We don't we say then that the pre-master secret used in RSA key exchange mode during an TLS handshake and the derived session key from it are ephemeral ? Of course it does not provide Forward Secrecy as it is using the same public key from servers certificate over and over again, but still the session key is generated on each session. What am I missing ?
Add a comment
|
1 Answer
The question is not very clear but let me try to provide an answer it from what I get.
The RSA exchange method is used to establish the pre-master key. The client generates a random value, use the server public key from the Server certificate from the Server Hello message to encrypt the pre-master secret key and send it to the server. Then the server can use its private key to sign a sample message to send it to the client so that the client can verify it to establish the identity of the server.
Since, the client sent a random value encrypted with the server's public key that can only be decrypted by the server, they now have a common random value that can server as a pre-master secret. Both, client and server can now derive their session key from it.
Since, the client generates it at every new handshake (not TLS session resumption), it's ephemeral.
You are right that the public key of the server never changes, and if the private key of the server gets compromised then anyone with the recordings o the messages over the wire can get the pre-master key and decrypt it, that too for all sessions hence NOT providing Perfect Forward Secrecy.
-
Thank you. So I guess it is safe to say that RSA in TLS is
ephermalbecause it generates for each session a random number thus computing a unique symmetric session key from it for each connection but it does not providePerfect Forward Secrecybecause once the servers private key is compromised all the previously captured and encrypted traffics can now be decrypted basically nullifying the value of using ephemeral session keys? Or am I still mixing things up ? Commented May 31, 2019 at 13:21 -
Or does
ephemeralin the context ofRSAmean that it would require a NEW RSA key-pair (pub-priv) for EACH SINGLE connection establishment (TCP 3 Way - TLS handshake) ? Commented May 31, 2019 at 13:35 -
Yes, you are correct in that case. If the server private key is compromised then the perfect forward secrecy is no longer valid. I will update the answer to reflect this. Thank you @blabla_trace Commented May 31, 2019 at 13:36
-
For plain-RSA kx through TLSv1.2, server could sign a message but it doesn't; instead it is authenticated by Finished. See rfcs 2246,4346,5246 and security.stackexchange.com/questions/61535/… and security.stackexchange.com/questions/71979/… vs security.stackexchange.com/questions/89834/… security.stackexchange.com/questions/90828/… Also the RSA premaster is not all random. Commented Jun 1, 2019 at 2:15
-