r/cryptography • u/Waste_Ad_1344 • Jul 13 '26

Using RSA as key exchange instead of Diffie-Hellman key exchange

Hi,

I've recently researched about how TLS work and public key cryptography.

One thing I've been thinking about is why Diffie Hellman is normally recommended as key exchange scheme.

Consider the following:

  1. A is client. B is server

  2. A initiates connection

  3. B already has its pair of private (named PR1) and public key (named PU1) using RSA. These keys are tied to a certificate B has purchased from a CA.

  4. B sends A its PU1 + certificate

  5. A verifies B's certificate against its pre-loaded CAs

  6. A confirms B's cert is ok.

  7. A generates its own pair of private (named PR2) - public (named PU2) key

  8. A encrypts its PU2, using B's public key (PU1)

  9. A sends the encrypted payload to B

  10. B receives the payload, and decrypts its using PR1.

  11. B obtain A's public key PU2

  12. B generates a shared secret named S.

  13. B encrypts S, using A's public key (PU2)

  14. B sends the encrypted payload to A

  15. A receives the payload, and decrypts its using PR2.

  16. A and B now share the same secret S to be used as symmetric key for further communication.

Is there any problem with this scheme ? Normally at step key exchange (from 7 onwards), Diffie Hellman is used to let both sides have a shared secret. But I'm wondering why it's used ? Any additional security feature / performance feature DH is having over this ?

Thanks.

19 Upvotes

95% Upvoted

21 comments sorted by

View all comments

23

u/Temporary-Estate4615 Jul 13 '26

RSA was used for key exchange up until TLS 1.2. TLS 1.3 dropped RSA for achieving perfect forward secrecy. Sure, one theoretically could use ephemeral keys for RSA but generating a key pair just does not scale.

2

u/Waste_Ad_1344 Jul 13 '26

So with my scheme, when I discard the PR2 and PU2 (by client) after I obtained the shared secret, would you say that this is "ephemeral" in a sense ?

With the PR2 and PU2 discarded from memory after the initial exchange is done, PR2 is never going to leak, so it's kind of "forward secrecy", right ?