# Why did RSA encryption become popular for key exchange?

This is a soft question. I don't know a lot about cryptography or its history, but it seems like a common use for RSA is to do key exchange by encrypting a symmetric key to send a longer message (e.g., the description of iMessage here). Isn't this exactly the thing that Diffie-Hellman key exchange, which is older (and to me seems simpler) is for? Looking at Wikipedia, they were also both patented, so this wouldn't have been responsible for the choice.

To be clear, I'm not asking whether it's theoretically important that public key cryptography is possible. I'm asking why it became a standard method in practice for doing key exchange. (To a non-cryptographer, DH looks easier to implement, and also isn't tied to the details of the group used.)

• RSA can also be used for secure key transmission in cases where an interactive key exchange protocol like DH are impossible, such as when only a one way link is available, or where round trip communication times are excessive. Use cases such an encrypted email favor such approaches, since the receiver's computer may not be connected to the internet at the moment you want to send the message, so cannot participate in an interactive key exchange. Apr 1, 2016 at 18:45
• Are you asking why it became popular for key exchange, or in general? Apr 2, 2016 at 9:14
• @KevinCathcart DH isn't necessarily interactive. The sender can create a single-use key-pair and send the public key along the message. That approach is the basis of ECIES/DLIES and ElGamal encryption. That has a slight size overhead (128 bytes for a 1024 bit key). Apr 2, 2016 at 11:53
• @CodesInChaos: But neither of those are key exchange algorithms. Once you have gone from key exchange to full fledged public key cryptography, the choice of underlying hard to reverse problem does not impact operational concerns like ensuring the sender has a copy of the receiver's public key. I understood the question to be asking, "Why do we often use public key crypto to exchange keys rather just a key exchange algorithm, which is often simpler?". Obviously, basically any public key algorithm can be used to establish a shared secret over a non-interactive channel. Apr 4, 2016 at 14:48

There is no strong technical reason. We could have used Diffie-Hellman (with appropriate signatures) just as well as RSA.

So why RSA? As far as I can tell, non-technical historical reasons dominated. RSA was patented and there was a company behind it, marketing and advocating for RSA. Also, there were good libraries, and RSA was easy to understand and familiar to developers. For these reasons, RSA was chosen, and once it was the popular choice, it stayed that way due to inertia.

These days, the main driver that has caused an increase of usage of Diffie-Hellman is the desire for perfect forward secrecy, something that is easy to achieve by using Diffie-Hellman but is slower with RSA.

Incidentally: It's Diffie-Hellman key exchange, not Diffie-Hellman secret sharing. Secret sharing is something else entirely.

• I thought the patents were more of a reason to avoid RSA? Apr 2, 2016 at 10:58
• @grawity that depends on how the patent holder behaves; and a generation ago tech patent holders hadn't collectively disgraced themselves via large scale and long duration lawfare to the extent that happened during the smartphone wars or mass small company patent trolling. Apr 2, 2016 at 17:12

Diffie–Hellman lacks a crucial feature: authentication. You know you are sharing a secret with someone, but you can't know if it's the recipient or a man in the middle. With RSA, you may have a few trusted parties who store public keys. If you want to connect to your bank, you can ask the trusted party (let's say Verisign) for the bank's public key, as you already have the public key of the trusted party on your computer. You know therefore that you are sharing a secret with your bank.

With Diffie–Hellman, when you create a secret with your bank, you may in fact create a secret with a man in the middle (MITM), who also create one with your bank, and he just has to translate from one encryption key to the other to remain invisible (while being able to read the whole communication).

• You can of course use RSA for authentication and then DH key exchange. Apr 1, 2016 at 17:53
• You could create a secret and public key pair like this: $p_k=g^{s_k} mod p$. By using that properly you can know who you are talking with. What you cannot do is after the fact prove to a third party what the other person said to you. Diffie-Hellman does as far as I know lack the capability to produce signatures. Apr 1, 2016 at 22:18
• @kasperd: I am surprised this has so many up votes. Apr 2, 2016 at 7:56
• You can either use long term Diffie-Hellman keys for authentication (look at CurveCP for an example protocol) or you can combine DH with DSA/Schnorr/ElGamal signatures (which share a lot of the underlying mathematics with DH), just like you can combine RSA Encryption with RSA signatures. Apr 2, 2016 at 11:55

The RSA Algorithm as previously mentioned is not that much better than Diffie–Hellman, the latter just lacks authentication also both the algorithms depend on the difficulty in finding discrete logarithms so security wise they are both pretty similar.

• Thank you for the contribution. However, everything you say has already been covered in other answers. We'd prefer that you answer questions that don't already have good answers, rather than duplicating existing answers. Also, RSA depends on the difficulty of the factoring problem (and strictly speaking on the RSA problem) rather than the discrete logarithm per se, whereas Diffie-Hellman is a more classic discrete log based system (strictly speaking, it relies on the DDH assumption).
– D.W.
Apr 2, 2016 at 5:16

There is a dark side to this which cannot be overlooked.
The fact that the RSA was co-opted by the NSA.
The NSA planted a backdoor in the Eliptic Curve cyhper which it supplied to the RSA.
http://www.intelligence-world.org/nsa-infiltrated-rsa-security-more-deeply-than-thought-study/

• This answer is incoherent. Elliptic curve cryptography is different from RSA. So a backdoor in elliptic curve crypto wouldn't endanger RSA. This answer is just wrong -- there is no such dark side.
– D.W.
Apr 4, 2016 at 20:48