Recently, while reviewing security, I thought of two questions regarding DH:
- Since asymmetric encryption algorithms can achieve secure key exchange with authentication, why is there still a need for the unauthenticated DH algorithm?
- The identity authentication in the asymmetric encryption algorithm system is actually based on the authority of a third-party CA. Can a DH CA be constructed?
This article aims to answer these two questions.
0. Overview of the DH Algorithm#
Anyone familiar with security algorithms knows that the DH algorithm is a widely used key exchange algorithm, often employed in the first phase of negotiations, such as TLS, IPsec, etc. Many people have a misconception that the DH algorithm belongs to asymmetric encryption algorithms, but we should understand that the DH algorithm does not have encryption and decryption capabilities, so it cannot be considered an asymmetric encryption algorithm; it can only be used for negotiating keys.
1. Principles of the DH Algorithm#
First, here is the principle diagram of the DH algorithm, a classic diagram from Wikipedia:
The key negotiation process of the DH algorithm is as follows:
- Alice takes a large random integer $x$ and sends it to Bob: $X = g^x \mod p$
- Bob takes a large random integer $y$ and sends it to Alice: $Y = g^y \mod p$
- Alice calculates $k=Y^x \mod p = (g^y \mod p)^x \mod p = g^{xy} \mod p$
- Alice calculates $k'=X^y \mod p = (g^x \mod p)^y \mod p = g^{xy} \mod p$
In the negotiation process, g and p are public, and X and Y are transmitted over the network. To compute x and y, one needs to solve the discrete logarithm problem.
Advantages#
- Simple computation
- Dynamic, easy to generate key pairs, re-generated for each negotiation
- Easily extendable to multiple parties $g^{xyz} \mod p$
Disadvantages#
- Lacks authentication capability, so it cannot solve the man-in-the-middle attack problem
2. Comparison with Asymmetric Encryption Algorithms#
Asymmetric encryption algorithms use public-private key pairs, where the public key encrypts and the private key decrypts, and vice versa. Compared to DH, the characteristics of asymmetric encryption algorithms include:
- Once the public-private key pair is generated, it cannot be modified
- Can be used for identity authentication
- Can construct an identity authentication system — digital certificate system
- Does not have forward secrecy (PFS); once the private key is leaked, all historical messages can be decrypted
Due to its authentication properties, it is often used for key exchange (information encryption), digital signatures, and identity authentication.
Why Do We Need DH#
Let's return to the questions:
- Since asymmetric encryption algorithms can achieve secure key exchange with authentication, why is there still a need for the unauthenticated DH algorithm?
Because the static nature and lack of forward secrecy in asymmetric encryption algorithms pose significant issues, meaning that once the private key is leaked, all historical messages will be compromised. The dynamic nature of DH can compensate for this; using the DH algorithm to rekey periodically means that the shared key between the communicating parties changes regularly. Even if one key is compromised, it does not allow access to the complete communication data.
However, since DH lacks authentication capabilities, it often needs to be combined with a digital certificate system to prevent man-in-the-middle attacks.
- The identity authentication in the asymmetric encryption algorithm system is actually based on the authority of a third-party CA. Can a DH CA be constructed?
This question is relatively easy to answer; the fundamental reason is that DH does not have authentication capabilities. In a PKI system, the CA uses its private key to issue certificates, and the user system/browser stores the CA's public key, allowing easy verification of the certificate's validity. This verification process is still based on the identity authentication properties of asymmetric encryption algorithms, which DH cannot achieve.
Done!
This article is synchronized and updated to xLog by Mix Space. The original link is https://www.vikifish.com/posts/security/why-we-need-dh-group