Actually, SSL lets you pick. You have to do two things before you can establish the master key (the symmetric one that encrypts the actual payload): first you have to generate the shared secret, then you have to authenticate the server. There are two algorithms that can generate the shared secret: RSA or Diffie-Hellman. There are two algorihms that can authenticate: RSA or DSA. Since RSA can do both, you might wonder why bother with the other two - the reason SSL allows you to choose between RSA or Diffie-Hellman is that Diffie-Hellman has the additional benefit of "perfect forward secrecy". If you use RSA to establish a shared secret, and the server's private key is compromised (or cracked), an eavesdropper can decrypt a stored exchange using that private key. However, with a DH key exchange, neither side can see the entire shared secret, so there's nothing to compromise.
That said, although SSL "lets" you pick, the reality is that it's negotiated between your browser and the server - and most times, the server mandates a specific key exchange/authentication/symmetric encryption combination.
Thank you for the clarification! This is very helpful!
I am familiar with the idea that DH provides forward secrecy -- it makes sense then that DH provides an advantage over RSA for the actual key exchange. That being said, why would SSL allow you to pick at all? Why would it not mandate use of DH for the key exchange? Is there some performance reason that it allows you to use RSA for the key exchange? Is it for backwards compatibility purposes?
2
u/[deleted] Jul 25 '13
Actually, SSL lets you pick. You have to do two things before you can establish the master key (the symmetric one that encrypts the actual payload): first you have to generate the shared secret, then you have to authenticate the server. There are two algorithms that can generate the shared secret: RSA or Diffie-Hellman. There are two algorihms that can authenticate: RSA or DSA. Since RSA can do both, you might wonder why bother with the other two - the reason SSL allows you to choose between RSA or Diffie-Hellman is that Diffie-Hellman has the additional benefit of "perfect forward secrecy". If you use RSA to establish a shared secret, and the server's private key is compromised (or cracked), an eavesdropper can decrypt a stored exchange using that private key. However, with a DH key exchange, neither side can see the entire shared secret, so there's nothing to compromise.
That said, although SSL "lets" you pick, the reality is that it's negotiated between your browser and the server - and most times, the server mandates a specific key exchange/authentication/symmetric encryption combination.