16
$\begingroup$

This is a soft question. I don't know a lot about cryptography or its history, but it seems like a common use for RSA is to do key exchange by encrypting a symmetric key to send a longer message (e.g., the description of iMessage here). Isn't this exactly the thing that Diffie-Hellman key exchange, which is older (and to me seems simpler) is for? Looking at Wikipedia, they were also both patented, so this wouldn't have been responsible for the choice.

To be clear, I'm not asking whether it's theoretically important that public key cryptography is possible. I'm asking why it became a standard method in practice for doing key exchange. (To a non-cryptographer, DH looks easier to implement, and also isn't tied to the details of the group used.)

Improve this question
$\endgroup$
8
  • 3
    $\begingroup$ There are some relevant questions on Crypto and Security; see Is there any particular reason to use Diffie-Hellman over RSA for key exchange?, How do other, non-RSA algorithms, compare to the PKCS #1 standard?, and What changed in PKCS#1 v2.2, and why? $\endgroup$
    – DylanSp
    Apr 1, 2016 at 17:08
  • 4
    $\begingroup$ RSA can also be used for secure key transmission in cases where an interactive key exchange protocol like DH are impossible, such as when only a one way link is available, or where round trip communication times are excessive. Use cases such an encrypted email favor such approaches, since the receiver's computer may not be connected to the internet at the moment you want to send the message, so cannot participate in an interactive key exchange. $\endgroup$
    – Kevin Cathcart
    Apr 1, 2016 at 18:45
  • $\begingroup$ Are you asking why it became popular for key exchange, or in general? $\endgroup$
    – OrangeDog
    Apr 2, 2016 at 9:14
  • $\begingroup$ @KevinCathcart DH isn't necessarily interactive. The sender can create a single-use key-pair and send the public key along the message. That approach is the basis of ECIES/DLIES and ElGamal encryption. That has a slight size overhead (128 bytes for a 1024 bit key). $\endgroup$
    – CodesInChaos
    Apr 2, 2016 at 11:53
  • $\begingroup$ @CodesInChaos: But neither of those are key exchange algorithms. Once you have gone from key exchange to full fledged public key cryptography, the choice of underlying hard to reverse problem does not impact operational concerns like ensuring the sender has a copy of the receiver's public key. I understood the question to be asking, "Why do we often use public key crypto to exchange keys rather just a key exchange algorithm, which is often simpler?". Obviously, basically any public key algorithm can be used to establish a shared secret over a non-interactive channel. $\endgroup$
    – Kevin Cathcart
    Apr 4, 2016 at 14:48

4 Answers 4

Reset to default
14
$\begingroup$

There is no strong technical reason. We could have used Diffie-Hellman (with appropriate signatures) just as well as RSA.

So why RSA? As far as I can tell, non-technical historical reasons dominated. RSA was patented and there was a company behind it, marketing and advocating for RSA. Also, there were good libraries, and RSA was easy to understand and familiar to developers. For these reasons, RSA was chosen, and once it was the popular choice, it stayed that way due to inertia.

These days, the main driver that has caused an increase of usage of Diffie-Hellman is the desire for perfect forward secrecy, something that is easy to achieve by using Diffie-Hellman but is slower with RSA.

Incidentally: It's Diffie-Hellman key exchange, not Diffie-Hellman secret sharing. Secret sharing is something else entirely.

Improve this answer
$\endgroup$
2
  • 2
    $\begingroup$ I thought the patents were more of a reason to avoid RSA? $\endgroup$
    – user1686
    Apr 2, 2016 at 10:58
  • $\begingroup$ @grawity that depends on how the patent holder behaves; and a generation ago tech patent holders hadn't collectively disgraced themselves via large scale and long duration lawfare to the extent that happened during the smartphone wars or mass small company patent trolling. $\endgroup$
    – Dan Is Fiddling By Firelight
    Apr 2, 2016 at 17:12
10
$\begingroup$

Diffie–Hellman lacks a crucial feature: authentication. You know you are sharing a secret with someone, but you can't know if it's the recipient or a man in the middle. With RSA, you may have a few trusted parties who store public keys. If you want to connect to your bank, you can ask the trusted party (let's say Verisign) for the bank's public key, as you already have the public key of the trusted party on your computer. You know therefore that you are sharing a secret with your bank.

With Diffie–Hellman, when you create a secret with your bank, you may in fact create a secret with a man in the middle (MITM), who also create one with your bank, and he just has to translate from one encryption key to the other to remain invisible (while being able to read the whole communication).

Improve this answer
$\endgroup$
4
  • $\begingroup$ You can of course use RSA for authentication and then DH key exchange. $\endgroup$
    – OrangeDog
    Apr 1, 2016 at 17:53
  • 4
    $\begingroup$ You could create a secret and public key pair like this: $p_k=g^{s_k} mod p$. By using that properly you can know who you are talking with. What you cannot do is after the fact prove to a third party what the other person said to you. Diffie-Hellman does as far as I know lack the capability to produce signatures. $\endgroup$
    – kasperd
    Apr 1, 2016 at 22:18
  • $\begingroup$ @kasperd: I am surprised this has so many up votes. $\endgroup$
    – Louis
    Apr 2, 2016 at 7:56
  • 1
    $\begingroup$ You can either use long term Diffie-Hellman keys for authentication (look at CurveCP for an example protocol) or you can combine DH with DSA/Schnorr/ElGamal signatures (which share a lot of the underlying mathematics with DH), just like you can combine RSA Encryption with RSA signatures. $\endgroup$
    – CodesInChaos
    Apr 2, 2016 at 11:55
-2
$\begingroup$

The RSA Algorithm as previously mentioned is not that much better than Diffie–Hellman, the latter just lacks authentication also both the algorithms depend on the difficulty in finding discrete logarithms so security wise they are both pretty similar.

Improve this answer
$\endgroup$
1
  • 2
    $\begingroup$ Thank you for the contribution. However, everything you say has already been covered in other answers. We'd prefer that you answer questions that don't already have good answers, rather than duplicating existing answers. Also, RSA depends on the difficulty of the factoring problem (and strictly speaking on the RSA problem) rather than the discrete logarithm per se, whereas Diffie-Hellman is a more classic discrete log based system (strictly speaking, it relies on the DDH assumption). $\endgroup$
    – D.W. ♦
    Apr 2, 2016 at 5:16
-3
$\begingroup$

There is a dark side to this which cannot be overlooked.
The fact that the RSA was co-opted by the NSA.
The NSA planted a backdoor in the Eliptic Curve cyhper which it supplied to the RSA.
http://www.intelligence-world.org/nsa-infiltrated-rsa-security-more-deeply-than-thought-study/

Improve this answer
$\endgroup$
1
  • 1
    $\begingroup$ This answer is incoherent. Elliptic curve cryptography is different from RSA. So a backdoor in elliptic curve crypto wouldn't endanger RSA. This answer is just wrong -- there is no such dark side. $\endgroup$
    – D.W. ♦
    Apr 4, 2016 at 20:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.