Re: Ephemeral Diffie-Hellman in SSL

According to David Wagner <daw-usenet@xxxxxxxxxxxxxxxxxxxxxxxx>:
As it turns out, naah, you don't have to do that for every SSL connection.
You can pre-generate and fix in advance the prime and generator, and
re-use them for many DH key exchanges. All you need to do to when a new
SSL session is created is to pick a random exponent x and compute y =
g^x. That's pretty fast.

Actually, you need not even get a new random x and compute g^x for each
connection. Nothing prevents the server from reusing the same key with
several connections. The cipher suite is called "ephemeral" so the
intent is that the DH private key shall have a rather short life, but
computing a new key every five minutes is ephemeral enough for most
purposes.

The point of an ephemeral key is that the private key needs not be
stored on any permanent storage area; it is kept in RAM only. This makes
that private key rather strong against future compromise (as opposed to
the permanent server key, the one which public counterpart is in the
server certificate), because the only choice for the attacker is to
cryptographically break the public key. There is no harddisk / smartcard
/ HSM that the attacker may physically open. In that respect, a SSL
server may choose its DH private key (the "x" value) at launch time,
hence only once every few weeks for a robust server.


--Thomas Pornin
.

Relevant Pages

  • [OT] Re: RSA implementation, please comment.
    ... on a separate server is actually a very good idea, ... This web front uses a well defined and secure ... Don't store the private key on the server. ... Every client gets a smartcard for the decryption (or a HSM, ...
    (comp.lang.perl.misc)
  • now SSL and ids ( was Re: ssh and ids )
    ... > How many simultaneous SSL sessions can be tracked? ... qualifies as a third party having access to the private key. ... communicate with the server in the clear. ... > best protection against covert channels is to stop the attacker before ...
    (Focus-IDS)
  • Re: Decrypting SSH traffic
    ... using the host's private key of the honeypot, ... OpenSSH server, which could be detected by an attacker. ... Or you could run the entire honeypot system inside an emulation ...
    (comp.security.ssh)
  • Re: TIPS FOR THE NEWCOMER
    ... As long as the private key is readable by the ssh client when it comes ... When the ssh client connects to the server, ... private key which matches the public key. ...
    (SSH)
  • Re: Private key generation
    ... As I wrote in my first answer to that thread - there are many situations when key pair is generated on trusted server. ... identity based encryption) simply requires generation of private key on server... ... High assurance keys (especially these that afterward are split in multiple shares using secret sharing schemes) may also require use of specialized equipment and computers that runs in a tempest/EM shielded locations. ... Default scenario supported by Microsoft Certificate Server is the most standard CA mode when CA just signs X509 certificate with emedded public keys. ...
    (microsoft.public.dotnet.security)
Quantcast