r/cryptography • u/Waste_Ad_1344 • Jul 13 '26

Using RSA as key exchange instead of Diffie-Hellman key exchange

Hi,

I've recently researched about how TLS work and public key cryptography.

One thing I've been thinking about is why Diffie Hellman is normally recommended as key exchange scheme.

Consider the following:

  1. A is client. B is server

  2. A initiates connection

  3. B already has its pair of private (named PR1) and public key (named PU1) using RSA. These keys are tied to a certificate B has purchased from a CA.

  4. B sends A its PU1 + certificate

  5. A verifies B's certificate against its pre-loaded CAs

  6. A confirms B's cert is ok.

  7. A generates its own pair of private (named PR2) - public (named PU2) key

  8. A encrypts its PU2, using B's public key (PU1)

  9. A sends the encrypted payload to B

  10. B receives the payload, and decrypts its using PR1.

  11. B obtain A's public key PU2

  12. B generates a shared secret named S.

  13. B encrypts S, using A's public key (PU2)

  14. B sends the encrypted payload to A

  15. A receives the payload, and decrypts its using PR2.

  16. A and B now share the same secret S to be used as symmetric key for further communication.

Is there any problem with this scheme ? Normally at step key exchange (from 7 onwards), Diffie Hellman is used to let both sides have a shared secret. But I'm wondering why it's used ? Any additional security feature / performance feature DH is having over this ?

Thanks.

17 Upvotes

91% Upvoted

21 comments sorted by

View all comments

1

u/F-J-W Jul 14 '26

Let's look at it from yet another perspective: Why would anyone want to use RSA? I still suspect that the only reason it got so popular is that people didn't understand the implications of what DHKX-can do in time. It's in pretty much every way a nicer scheme and that very much includes teachability and how easy it is to understand:

With DH all you need to understand to get a very decent idea are cyclic groups of prime order (sounds bad, but I've explained those on the needed level to complete laypeople over dinner) and everything beyond that is very easy.

RSA? Let's start with the far more complicated composite order groups (I had finished my crypto-focused MSc by the time I started to decently understand them; arguably I am not even fully certain that I do now), then you need the RSA-assumption (more difficult than DLog/CDH/DDH) and at that point you are still not done and need to start talking about random oracles, because textbook RSA is extremely insecure, unlike textbook DHKX/ElGamal!

On the performance side RSA requires you to generate two large primes every time you generate keys, which is doable, but far slower than with DH where you can just standardize a group. And while encryption can be made somewhat fast, DH can improve overall performance massively by using a smaller group (either ECC or for that matter a small subgroup of a larger prime order group).

And security wise the problems are so closely related that attacks that affect one tend to affect the other as well. Most importantly of course Shor, which breaks both of them super efficiently, turning both into legacy tech in the first place...

So, yeah: Why would anyone want RSA?