3

In addition to achieving PFS with DHE, we want as little as possible to be revealed when the server's private key is revealed. So, what is RSA used for in DHE_RSA cipher suites? What does the server sign during the key exchange?

  • I don't see how "we want as little as possible to be revealed when the server's private key is revealed" is related to "What does the server sign during the key exchange?". The whole handshake is in the clear. – CodesInChaos Dec 1 '13 at 16:37
5

In a cipher suite like "TLS_DHE_RSA_WITH_AES_256_CBC_MD5" RSA is used for authentication, while AES (256 bit) in CBC mode is used for encryption.

Authentication is needed since Diffie-Hellman is vulnerable to Man-in-the-Middle attacks. An attacker could easily exchange the Diffie-Hellmann paramater and would therefore be able to intercept the communication later. So signed Diffie-Hellman parameter ensure, that a Man-in-the-Middle attack would be detected. There is a variant of Diffie-Hellman key exchange called anonymous Diffie-Hellman (DH_anon) which doesn't use authentication.

The server signs the Diffie-Hellman parameter (via RSA) from which the so called pre-master secret is derived. From the pre-master secret the master secret is later calculated, from which in turn the symmetric 256 bit AES key is generated. Remember that the Diffie-Hellman parameter being exchanged are public, so they are not encrypted with RSA. They just get signed.

I took most of this from here which is a nice summary of the whole topic. Unfortunately it's only in German, but maybe the figures still help you. You can find more detailed information in RFC 5246.

3

Instead of saying Authentication is needed since Diffie-Hellman is vulnerable to Man-in-the-Middle attacks, which is no doubt a valid statement, another way of looking at this is to start with TLS_RSA_WITH_AES_256_CBC_SHA256 which is still in use today, see the problem with it and how DHE solves it. Here, RSA public key cryptography is used for 2 things:

    a) for client to authenticate the server and
    b) key exchange, where the client generates
       a session key and encrypts it [1] with the server's public key.

A problem arises because RSA is used for both authentication and key exchange. If an adversary stores the encrypted sessions until they somehow acquire the RSA private key, they can now decrypt the encrypted session key and decrypt the communications. The solution is to use RSA only for authentication and use Diffie-Hellman2 for key exchange. Once client authenticates the server using RSA, they exchange Diffie-Hellman public keys and independently compute the session key. Any man-in-the-middle can see the Diffie Hellman public keys but cannot compute the session key as there is no efficient solution for the Discrete-Logarithm problem. Given that the session is short lived and every session uses different DH-public-private-key pairs, and to distinguish it from DH-public-key-certificate where a fixed public/private key pair is used, the term DHE is used where E stands for ephemeral. Now, even if an adversary acquires the RSA private key, they cannot decrypt prior-stored encrypted communications because they cannot compute the session key --- this is the forward in PFS. Maybe they should have called it Perfect Prior Security!

Regarding "What does the server sign during the key exchange", among other things, the server signs the diffie-hellman values (which are part of the Server Key Exchange message) with its private key.

You mentioned "we want as little as possible to be revealed when the server's private key is revealed". But note that if an adversary acquires the RSA private key it can be quite damaging to new communications. They may be able to impersonate the server and fool the client into providing login credentials. Adversary can also act as man-in-the-middle where there is a connection between the client and the adversary and another from the adversary to the genuine server. In both cases, it doesn't matter if DHE is used or not.

Footnotes:

  1. Actually a premaster key is encrypted and the session key derived from that
  2. Should be called Diffie–Hellman–Merkle

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.