16
$\begingroup$

This is a soft question. I don't know a lot about cryptography or its history, but it seems like a common use for RSA is to do key exchange by encrypting a symmetric key to send a longer message (e.g., the description of iMessage here). Isn't this exactly the thing that Diffie-Hellman key exchange, which is older (and to me seems simpler) is for? Looking at Wikipedia, they were also both patented, so this wouldn't have been responsible for the choice.

To be clear, I'm not asking whether it's theoretically important that public key cryptography is possible. I'm asking why it became a standard method in practice for doing key exchange. (To a non-cryptographer, DH looks easier to implement, and also isn't tied to the details of the group used.)

$\endgroup$
  • 3
  • 3
    $\begingroup$ RSA can also be used for secure key transmission in cases where an interactive key exchange protocol like DH are impossible, such as when only a one way link is available, or where round trip communication times are excessive. Use cases such an encrypted email favor such approaches, since the receiver's computer may not be connected to the internet at the moment you want to send the message, so cannot participate in an interactive key exchange. $\endgroup$ – Kevin Cathcart Apr 1 '16 at 18:45
  • $\begingroup$ Are you asking why it became popular for key exchange, or in general? $\endgroup$ – OrangeDog Apr 2 '16 at 9:14
  • $\begingroup$ @KevinCathcart DH isn't necessarily interactive. The sender can create a single-use key-pair and send the public key along the message. That approach is the basis of ECIES/DLIES and ElGamal encryption. That has a slight size overhead (128 bytes for a 1024 bit key). $\endgroup$ – CodesInChaos Apr 2 '16 at 11:53
  • $\begingroup$ @CodesInChaos: But neither of those are key exchange algorithms. Once you have gone from key exchange to full fledged public key cryptography, the choice of underlying hard to reverse problem does not impact operational concerns like ensuring the sender has a copy of the receiver's public key. I understood the question to be asking, "Why do we often use public key crypto to exchange keys rather just a key exchange algorithm, which is often simpler?". Obviously, basically any public key algorithm can be used to establish a shared secret over a non-interactive channel. $\endgroup$ – Kevin Cathcart Apr 4 '16 at 14:48
14
$\begingroup$

There is no strong technical reason. We could have used Diffie-Hellman (with appropriate signatures) just as well as RSA.

So why RSA? As far as I can tell, non-technical historical reasons dominated. RSA was patented and there was a company behind it, marketing and advocating for RSA. Also, there were good libraries, and RSA was easy to understand and familiar to developers. For these reasons, RSA was chosen, and once it was the popular choice, it stayed that way due to inertia.

These days, the main driver that has caused an increase of usage of Diffie-Hellman is the desire for perfect forward secrecy, something that is easy to achieve by using Diffie-Hellman but is slower with RSA.

Incidentally: It's Diffie-Hellman key exchange, not Diffie-Hellman secret sharing. Secret sharing is something else entirely.

$\endgroup$
  • 2
    $\begingroup$ I thought the patents were more of a reason to avoid RSA? $\endgroup$ – grawity Apr 2 '16 at 10:58
  • $\begingroup$ @grawity that depends on how the patent holder behaves; and a generation ago tech patent holders hadn't collectively disgraced themselves via large scale and long duration lawfare to the extent that happened during the smartphone wars or mass small company patent trolling. $\endgroup$ – Dan Neely Apr 2 '16 at 17:12
10
$\begingroup$

Diffie–Hellman lacks a crucial feature: authentication. You know you are sharing a secret with someone, but you can't know if it's the recipient or a man in the middle. With RSA, you may have a few trusted parties who store public keys. If you want to connect to your bank, you can ask the trusted party (let's say Verisign) for the bank's public key, as you already have the public key of the trusted party on your computer. You know therefore that you are sharing a secret with your bank.

With Diffie–Hellman, when you create a secret with your bank, you may in fact create a secret with a man in the middle (MITM), who also create one with your bank, and he just has to translate from one encryption key to the other to remain invisible (while being able to read the whole communication).

$\endgroup$
  • $\begingroup$ You can of course use RSA for authentication and then DH key exchange. $\endgroup$ – OrangeDog Apr 1 '16 at 17:53
  • 4
    $\begingroup$ You could create a secret and public key pair like this: $p_k=g^{s_k} mod p$. By using that properly you can know who you are talking with. What you cannot do is after the fact prove to a third party what the other person said to you. Diffie-Hellman does as far as I know lack the capability to produce signatures. $\endgroup$ – kasperd Apr 1 '16 at 22:18
  • $\begingroup$ @kasperd: I am surprised this has so many up votes. $\endgroup$ – Louis Apr 2 '16 at 7:56
  • 1
    $\begingroup$ You can either use long term Diffie-Hellman keys for authentication (look at CurveCP for an example protocol) or you can combine DH with DSA/Schnorr/ElGamal signatures (which share a lot of the underlying mathematics with DH), just like you can combine RSA Encryption with RSA signatures. $\endgroup$ – CodesInChaos Apr 2 '16 at 11:55
-2
$\begingroup$

The RSA Algorithm as previously mentioned is not that much better than Diffie–Hellman, the latter just lacks authentication also both the algorithms depend on the difficulty in finding discrete logarithms so security wise they are both pretty similar.

$\endgroup$
  • 2
    $\begingroup$ Thank you for the contribution. However, everything you say has already been covered in other answers. We'd prefer that you answer questions that don't already have good answers, rather than duplicating existing answers. Also, RSA depends on the difficulty of the factoring problem (and strictly speaking on the RSA problem) rather than the discrete logarithm per se, whereas Diffie-Hellman is a more classic discrete log based system (strictly speaking, it relies on the DDH assumption). $\endgroup$ – D.W. Apr 2 '16 at 5:16
-3
$\begingroup$

There is a dark side to this which cannot be overlooked.
The fact that the RSA was co-opted by the NSA.
The NSA planted a backdoor in the Eliptic Curve cyhper which it supplied to the RSA.
http://www.intelligence-world.org/nsa-infiltrated-rsa-security-more-deeply-than-thought-study/

$\endgroup$
  • 1
    $\begingroup$ This answer is incoherent. Elliptic curve cryptography is different from RSA. So a backdoor in elliptic curve crypto wouldn't endanger RSA. This answer is just wrong -- there is no such dark side. $\endgroup$ – D.W. Apr 4 '16 at 20:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.