DH vs. DHE and ECDHE and perfect forward secrecy

ssl public-key-encryption diffie-hellman
user1810868 picture user1810868 · Dec 25, 2012 · Viewed 44.7k times · Source

Does Diffie-Hellman (DH) provide perfect forward secrecy? or is it a feature for Ephemeral Diffie-Hellman (DHE) only ? Is Elliptic Curve Ephemeral diffie-Hellman (ECDHE) is better than DHE ?

Answer

Bruno picture Bruno · Dec 26, 2012

It's the ephemeral aspect of DHE and ECDHE that provides perfect forward secrecy.

The idea is that even if someone records traffic and compromises the server to get its private key, they won't be able to decipher that traffic, because they'll be missing the ephemeral DH parameters that won't have been saved. With fixed DH, the private DH parameters are effectively the private key: they would also be compromised in the same way and allow the attacker to decipher past traffic too. (Note that support for fixed DH, non-anonymous cipher suites is quite rare in practice anyway.)

The perfect forward secrecy offered by DHE comes at a price: more computation. The ECDHE variants uses elliptic curve cryptography to reduce this computational cost. You may find further details and benchmarks in Vincent Bernat's SSL/TLS & Perfect Forward Secrecy article.

Related questions

Which symmetric key algorithm does SSL use?

I understand that through SSL, the browser gets the public key of the secured website and through public key encryption rsa algorithm, these 2 establish session key and then continue communication thru some symmetric algorithm, because symmetric key encryption/decryption is …

Read More
How to create a self-signed certificate with OpenSSL

I'm adding HTTPS support to an embedded Linux device. I have tried to generate a self-signed certificate with these steps: openssl req -new > cert.csr openssl rsa -in privkey.pem -out key.pem openssl x509 -in cert.csr -out …

Read More
Getting Chrome to accept self-signed localhost certificate

I have created a self-signed SSL certificate for the localhost CN. Firefox accepts this certificate after initially complaining about it, as expected. Chrome and IE, however, refuse to accept it, even after adding the certificate to the system certificate store …

Read More