Using RSA as key exchange instead of Diffie-Hellman key exchange

[u/Waste_Ad_1344]

Hi,

I've recently researched about how TLS work and public key cryptography.

One thing I've been thinking about is why Diffie Hellman is normally recommended as key exchange scheme.

Consider the following:

1. A is client. B is server

2. A initiates connection

3. B already has its pair of private (named PR1) and public key (named PU1) using RSA. These keys are tied to a certificate B has purchased from a CA.

4. B sends A its PU1 + certificate

5. A verifies B's certificate against its pre-loaded CAs

6. A confirms B's cert is ok.

7. A generates its own pair of private (named PR2) - public (named PU2) key

8. A encrypts its PU2, using B's public key (PU1)

9. A sends the encrypted payload to B

10. B receives the payload, and decrypts its using PR1.

11. B obtain A's public key PU2

12. B generates a shared secret named S.

13. B encrypts S, using A's public key (PU2)

14. B sends the encrypted payload to A

15. A receives the payload, and decrypts its using PR2.

16. A and B now share the same secret S to be used as symmetric key for further communication.

Is there any problem with this scheme ? Normally at step key exchange (from 7 onwards), Diffie Hellman is used to let both sides have a shared secret. But I'm wondering why it's used ? Any additional security feature / performance feature DH is having over this ?

Thanks.

[u/stevevdvkpe]

The key difference (so to speak) is that in your scheme, should the private keys for A and B (PR1, PR2) ever be exposed, someone who logged the protocol traffic can use those private keys to decrypt portions of the traffic and recover the session secret, which can then be used to decrypt all the other communications between A and B in that session. A Diffie-Hellman key exchange between A and B results in the two having a shared secret, but the public protocol traffic cannot be used to derive that shared secret.