I have read some textbooks and not found a convincing explanation.

In the cipher suite ECDHE-RSA-AES128-GCM-SHA256, what is the role of RSA in the first part (ECDHE-RSA)? This part of the cipher suite indicates the key exchange algorithm, right? That is what ECDHE is used for: key exchange, so why do we need RSA?

Are both algorithms used to exchange the keys? I’m a bit confused about that.

Obviously, it is not necessary to explain ECDHE or RSA separately. I just want an explanation of how they work in this context.

marked as duplicate by RoraΖ, Steve Dodier-Lazaro, Christopher, Steve, TildalWave May 27 '15 at 6:47

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.


ECDHE by itself is worthless against an active attacker -- there's no way to tie the received ECDH key to the site you're trying to visit, so an attacker could just send their own ECDH key. This is because ECDHE is ephemeral, meaning that the server's ECDH key isn't in its certificate. So, the server signs its ECDH key using RSA, with the RSA public key being the thing in the server's certificate.

  • For the signature with RSA, which scheme is applied ? with Appendix SSA or with recovery PSSR ? – EisenHeim Sep 9 '15 at 10:14
  • @SteffenUllrich: the certificated key which here is RSA is used to authenticate by signing nonces plus the body of the ServerKeyExchange message which here is the ECDHE curve+publickey. See rfc4492 5.4 (skipping over 2+ pages about explicit curves that no one uses and 1.3 will discard). – dave_thompson_085 Nov 23 '17 at 1:02
  • (late but) @Eisenheim: the RSA signature currently used is RSASSA-PKCS1v1_5 which is appendix (in TLS1.1 and below with nonstandard concatenated SHA1 and MD5; TLS1.0 permitted old PKCS1 block type 0 which is no longer standard, but I don't think anyone used it); 1.3 will prefer RSA-PSS which is also appendix. – dave_thompson_085 Nov 23 '17 at 1:02
  • @dave_thompson_085: you are right and thanks for enlightening me. I've removed my wrong comment. – Steffen Ullrich Nov 23 '17 at 5:58
 $ openssl ciphers -V ECDHE-RSA-AES128-GCM-SHA256
 ... Kx=ECDH     Au=RSA  Enc=AESGCM(128) Mac=AEAD

That means the key exchange (Kx) is ECDH, but the authentication part (Au, i.e. the validation of the certificate) is RSA, so it expects a certificate with a RSA key inside.


Cipher suite name is made up of :

  • TLS prefix
  • Key Exchange algorithm
  • Authentication algorithm
  • Encryption algorithm
  • Encryption strength
  • Encryption mode
  • MAC or PRF function (depending on TLS version)

In your case elliptic curve diffie-hellman key exchange will be used in ephemeral mode (which provides forward secrecy) and this exchange will be authenticated with RSA signature.


RSA is used to authenticate the server while ECDHE is used to generate a shared secret between the client and server.

Concretely, this means the server signs with its RSA private key the ephemeral ECDH parameters (public key) it sends to the client.

This is how the client knows the ECDH public key belongs to the server and not to some MITM.

You could see this as the server acting as an CA of sorts, one which signs single use public keys.

Not the answer you're looking for? Browse other questions tagged or ask your own question.