I am getting confused with RSA, Diffie-Hellman Key Exchange, PKI and X.509v3.

RSA's mathematics algorithm seems like an encryption algorithm, right? Generating public key and private key, using for encryption and decryption...

Diffie-Hellman's mathematics algorithm seems just like a key exchange, right? Each side can calculate the same key by using some kinds of algorithm. It seems not an encryption, right?

For PKI, there is something new which is the CA and digital certificate. Public key and private key are also mentioned.

So, what is the relationship between these concepts? Are they 3 separate concepts? Or they will be used together in reality?

Also, is X.509 the standard of PKI? So PKI itself is not a standard?

2 Answers 2


RSA is two algorithms, one for asymmetric encryption, the other one for digital signatures. They use the same kind of keys, they share the same core operation, and they are both called "RSA".

Diffie-Hellman is a key exchange algorithm; you can view it as a kind of asymmetric encryption algorithm where you do not get to choose what you encrypt. This is fine for key exchange, where you just want to obtain an essentially random shared secret between two people. Note that most usages of RSA asymmetric encryption, in practice, are also key exchange, e.g. in SSL/TLS: the client generates a random value, encrypts it with the server's public key, and send it to the server.

PKI is a concept. It builds on the notion of certificate: a certificate is an assertion of key ownership. Basically, a certificate is an object that contains an identity (a name) and a public key, and the object is digitally signed (e.g. with RSA -- the signature algorithm -- or ECDSA). A certificate is validated by verifying this signature. The idea is that if I know the public key of whoever issued (signed) the certificate, then I can verify that signature, and thereby gain some confidence in the fact that the public key contained in the certificate really belongs to the entity designated by the identity contained in the certificate.

When you organize certificates in a way such that there is a strict hierarchy, where certificate issuers are called Certification Authorities and issue certificates to each other, with a handful of top-CA called "root CA", then that overall structure is called a Public Key Infrastructure, i.e. a PKI.

X.509 is a standard for the format and contents of certificates. X.509 is rather open about what signature algorithms will be used for signing certificates, but in practice, 99% of the time, it will be RSA.

  • Thanks for your answers. I feel much clear right now. In PKI, we always say that encrypt with public key and decrypt with private key. Actually, is RSA always be the methodology? Such as generating key for encryption and decryption. Also, X.509 is the standards that defined the format and content of digital certificate such as issuer, serial number or version, etc? Would you mind to explain more about diffie-hellman key exchange? How it actually apply in reality and operate with RSA and PKI? Thanks you very much, I am really grateful. Feb 5, 2015 at 11:50

Ok, let's not get confused. PKI (Public Key Infrastructure) is a management infrastructure created to issue X.509 certificates. X.509 certificates are signed by the certificate authority and can contain an RSA public key among other information. RSA is an Asymmetric encryption method that creates public and private key pairs. Diffie-Hellman key exchange is a method to create a shared secret. The shared secret is never exchanged, instead, a mathematical equation is performed on each side where each side figures out what is the shared secret.

  • I'm not sure what this adds to the existing answer ... Please don't copy answers, upvote them.
    – schroeder
    Feb 29 at 16:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .