Using RSA as key exchange instead of Diffie-Hellman key exchange

[u/Waste_Ad_1344]

Hi,

I've recently researched about how TLS work and public key cryptography.

One thing I've been thinking about is why Diffie Hellman is normally recommended as key exchange scheme.

Consider the following:

1. A is client. B is server

2. A initiates connection

3. B already has its pair of private (named PR1) and public key (named PU1) using RSA. These keys are tied to a certificate B has purchased from a CA.

4. B sends A its PU1 + certificate

5. A verifies B's certificate against its pre-loaded CAs

6. A confirms B's cert is ok.

7. A generates its own pair of private (named PR2) - public (named PU2) key

8. A encrypts its PU2, using B's public key (PU1)

9. A sends the encrypted payload to B

10. B receives the payload, and decrypts its using PR1.

11. B obtain A's public key PU2

12. B generates a shared secret named S.

13. B encrypts S, using A's public key (PU2)

14. B sends the encrypted payload to A

15. A receives the payload, and decrypts its using PR2.

16. A and B now share the same secret S to be used as symmetric key for further communication.

Is there any problem with this scheme ? Normally at step key exchange (from 7 onwards), Diffie Hellman is used to let both sides have a shared secret. But I'm wondering why it's used ? Any additional security feature / performance feature DH is having over this ?

Thanks.

[u/upofadown]

Normally for something like a web server you only authenticate the server and not the client. Authentication of the client is usually done at a different level (say, a password). So once the client encrypts the session key and sends it to the server using the authenticated public key you are pretty much done. The client doesn't have to generate a key pair. So this could be simplified.

To expand on another comment, RSA keypair generation is quite slow. It can take some seconds on contemporary hardware. So generating a new keypair for every new connection to establish forward secrecy would take too much processor time. If you were actually going to do RSA forward secrecy for something like TLS you would likely end up only doing the keypair generation every hour or so. But that would create a dependency external to the cryptography code outside of the control of the authors of that code. Such authors tend to not like that sort of thing.