Return to Question

I have been reading Bulletproof SSL and TLS

Diffie Hellman is a key exchange mechanism, in which each of server and client share secret i.e. g^x and g^y respectively with each other where g is generator of some group. They calculate secret S = (g^y)^x and (g^x)^y respectively. Note that an attacker in the middle cannot get the value of S from g^x and g^y, since discrete logarithm is a hard problem. But, an active attacker can masquerade and fool both server and client.

Now in RSA_DH, the value which server sends to client i.e. g^x is fixed and stored in certificate. So, the "ServerKeyExchange" message is not sent. Now, client sends its g^y value in "ClientKeyExchange" message and this is encrypted with RSA public key cryptography algorithm whose certificate server has already sent in "Certificate" message.

In RSA_DHE, the "ServerKeyExchange" message takes place where server sends g^x to the client.

Now my question is what is the difference between the two? Since the premaster secret is calculated from the value (g^x)^y, Therefore, even in RSA_DH, if the client sends different g^y values in each session, then (g^x)^y value will be different. (I think even if he doesn't still my argument holds) Therefore it will achieve forward secrecy as in RSA_DHE. And the poor attacker won't be able to get premaster secret even after getting the value of g^y by compromising the server private key. So, in both cases he won't be able to calculate premaster secret. So why Ephemeral one (RSA_DHE) is said to achieve forward secrecy and other one not?

I have been reading Bulletproof SSL and TLS

Diffie Hellman is a key exchange mechanism, in which each of server and client share secret i.e. g^x and g^y respectively with each other where g is generator of some group. They calculate secret S = (g^y)^x and (g^x)^y respectively. Note that an attacker in the middle cannot get the value of S from g^x and g^y, since discrete logarithm is a hard problem. But, an active attacker can masquerade and fool both server and client.

Now in RSA_DH, the value which server sends to client i.e. g^x is fixed and stored in certificate. So, the "ServerKeyExchange" message is not sent. Now, client sends its g^y value in "ClientKeyExchange" message and this is encrypted with RSA public key cryptography algorithm whose certificate server has already sent in "Certificate" message.

In RSA_DHE, the "ServerKeyExchange" message takes place where server sends g^x to the client.

Now my question is what is the difference between the two? Since the premaster secret is calculated from the value (g^x)^y, Therefore, even in RSA_DH, if the client sends different g^y values in each session, then (g^x)^y value will be different. (I think even if he doesn't still my argument holds) Therefore it will achieve forward secrecy as in RSA_DHE. And the poor attacker won't be able to get premaster secret even after getting the value of g^y by compromising the server private key. So, in both cases he won't be able to calculate premaster secret. So why Ephemeral one (RSA_DHE) is said to achieve forward secrecy and other one not?

I have been reading Bulletproof SSL and TLS

Diffie Hellman is a key exchange mechanism, in which each of server and client share secret i.e. g^x and g^y respectively with each other where g is generator of some group. They calculate secret S = (g^y)^x and (g^x)^y respectively. Note that an attacker in the middle cannot get the value of S from g^x and g^y, since discrete logarithm is a hard problem. But, an active attacker can masquerade and fool both server and client.

Now in RSA_DH, the value which server sends to client i.e. g^x is fixed and stored in certificate. So, the "ServerKeyExchange" message is not sent. Now, client sends its g^y value in "ClientKeyExchange" message and this is encrypted with RSA public key cryptography algorithm whose certificate server has already sent in "Certificate" message.

In RSA_DHE, the "ServerKeyExchange" message takes place where server sends g^x to the client.

Now my question is what is the difference between the two? Since the premaster secret is calculated from the value (g^x)^y, Therefore, even in RSA_DH, if the client sends different g^y values in each session, then (g^x)^y value will be different. (I think even if he doesn't still my argument holds) Therefore it will achieve forward secrecy as in RSA_DHE. And the poor attacker won't be able to get premaster secret even after getting the value of g^y by compromising the server private key. So, in both cases he won't be able to calculate premaster secret. So why Ephemeral one (RSA_DHE) is said to achieve forward secrecy and other one not?

I have been reading Bulletproof SSL and TLS

Diffie Hellman is a key exchange mechanism, in which each of server and client share secret i.e. g^x and g^y respectively with each other where g is generator of some group. They calculate secret S = (g^y)^x and (g^x)^y respectively. Note that an attacker in the middle cannot get the value of S from g^x and g^y, since discrete logarithm is a hard problem. But, an active attacker can masquerade and fool both server and client.

Now in RSA_DH, the value which server sends to client i.e. g^x is fixed and stored in certificate. So, the "ServerKeyExchange" message is not sent. Now, client sends its g^y value in "ClientKeyExchange" message and this is encrypted with RSA public key cryptography algorithm whose certificate server has already sent in "Certificate" message.

In RSA_DHE, the "ServerKeyExchange" message takes place where server sends g^x to the client.

Now my question is what is the difference between the two? Since the premaster secret is calculated from the value (g^x)^y, Therefore, even in RSA_DH, if the client sends different g^y values in each session, then (g^x)^y value will be different. (I think even if he doesn't still my argument holds) Therefore it will achieve forward secrecy as in RSA_DHE. And the poor attacker won't be able to get premaster secret even after getting the value of g^y by compromising the server private key. So, in both cases he won't be able to calculate premaster secret. So why Ephemeral one (RSA_DHE) is said to achieve forward secrecy and other one not?

I have been reading Bulletproof SSL and TLS

Diffie Hellman is a key exchange mechanism, in which each of server and client share secret i.e. g^x and g^y respectively with each other where g is generator of some group. They calculate secret S = (g^y)^x and (g^x)^y respectively. Note that an attacker in the middle cannot get the value of S from g^x and g^y, since discrete logarithm is a hard problem. But, an active attacker can masquerade and fool both server and client.

Now in RSA_DH, the value which server sends to client i.e. g^x is fixed and stored in certificate. So, the "ServerKeyExchange" message is not sent. Now, client sends its g^y value in "ClientKeyExchange" message and this is encrypted with RSA public key cryptography algorithm whose certificate server has already sent in "Certificate" message.

In RSA_DHE, the "ServerKeyExchange" message takes place where server sends g^x to the client.

Now my question is what is the difference between the two, since the premaster secret i.e. calculated from the value (g^x)^y. Therefore, even in RSA_DH, if the client sends different y values in each session, then (g^x)^y value will be different. Therefore it will achieve forward secrecy as is the case in RSA_DHE.

I have been reading Bulletproof SSL and TLS

Diffie Hellman is a key exchange mechanism, in which each of server and client share secret i.e. g^x and g^y respectively with each other where g is generator of some group. They calculate secret S = (g^y)^x and (g^x)^y respectively. Note that an attacker in the middle cannot get the value of S from g^x and g^y, since discrete logarithm is a hard problem. But, an active attacker can masquerade and fool both server and client.

Now in RSA_DH, the value which server sends to client i.e. g^x is fixed and stored in certificate. So, the "ServerKeyExchange" message is not sent. Now, client sends its g^y value in "ClientKeyExchange" message and this is encrypted with RSA public key cryptography algorithm whose certificate server has already sent in "Certificate" message.

In RSA_DHE, the "ServerKeyExchange" message takes place where server sends g^x to the client.

Now my question is what is the difference between the two? Since the premaster secret is calculated from the value (g^x)^y, Therefore, even in RSA_DH, if the client sends different g^y values in each session, then (g^x)^y value will be different. (I think even if he doesn't still my argument holds) Therefore it will achieve forward secrecy as in RSA_DHE. And the poor attacker won't be able to get premaster secret even after getting the value of g^y by compromising the server private key. So, in both cases he won't be able to calculate premaster secret. So why Ephemeral one (RSA_DHE) is said to achieve forward secrecy and other one not?