Recently, while reviewing security, I thought of two questions regarding DH:
- Since asymmetric encryption algorithms can achieve secure key exchange with authentication, why is there still a need for the unauthenticated DH algorithm?
- The identity authentication in the asymmetric encryption algorithm system is actually based on the authority of a third-party CA. Can a set of DH CA be constructed?
This article aims to answer these two questions.
0. Overview of DH Algorithm#
Anyone familiar with security algorithms knows that the DH algorithm is a widely used key exchange algorithm, often used in the first phase of negotiations, such as TLS, IPsec, etc. Many people have a misconception that the DH algorithm belongs to asymmetric encryption algorithms, but we should know that the DH algorithm does not have encryption and decryption functions, so it cannot be considered an asymmetric encryption algorithm; it can only be used for negotiating keys.
1. Principle of DH Algorithm#
First, here is the principle diagram of the DH algorithm, a classic diagram from Wikipedia:
The key negotiation process of the DH algorithm is as follows:
- Alice takes a large random integer $x$ and sends it to Bob: $X = g^x \mod p$
- Bob takes a large random integer $y$ and sends it to Alice: $Y = g^y \mod p$
- Alice calculates $k=Y^x \mod p = (g^y \mod p)^x \mod p = g^{xy} \mod p$
- Alice calculates $k'=X^y \mod p = (g^x \mod p)^y \mod p = g^{xy} \mod p$
In the negotiation process, g and p are public, and X and Y are transmitted over the network. To compute x and y, one needs to solve the discrete logarithm problem.
Advantages#
- Simple computation
- Dynamic, easy to generate key pairs, and re-generated for each negotiation
- Easily extendable to multiple parties $g^{xyz} \mod p$
Disadvantages#
- Lacks authentication capability, so it cannot solve the man-in-the-middle attack problem
2. Comparison with Asymmetric Encryption Algorithms#
Asymmetric encryption algorithms use public-private key pairs, where the public key encrypts and the private key decrypts, and vice versa. Compared to DH, the characteristics of asymmetric encryption algorithms include:
- Once the public-private key pair is generated, it cannot be modified
- Can be used for identity authentication
- Can construct an identity authentication system — digital certificate system
- Does not have forward secrecy (PFS); once the private key is leaked, all historical messages can be decrypted
Due to its authentication properties, it is often used for key exchange (information encryption), digital signatures, and identity authentication.
Why Do We Need DH#
Let's return to the questions:
- Since asymmetric encryption algorithms can achieve secure key exchange with authentication, why is there still a need for the unauthenticated DH algorithm?
Because the static nature and lack of forward secrecy in asymmetric encryption algorithms pose significant issues. This means that once the private key is leaked, all historical messages will be compromised. The dynamic nature of DH can compensate for this; by using the DH algorithm to rekey periodically, the shared key between the communicating parties changes periodically. Even if one key is compromised, it does not allow access to the complete communication data.
However, since DH lacks authentication capability, it often needs to be combined with a digital certificate system to prevent man-in-the-middle attacks.
- The identity authentication in the asymmetric encryption algorithm system is actually based on the authority of a third-party CA. Can a set of DH CA be constructed?
This question is relatively easy to answer; the fundamental reason is that DH does not have authentication functionality. In the PKI system, the CA uses the private key to issue certificates, and the user system/browser stores the CA public key, which can easily verify the validity of the certificate. This verification process is still based on the identity authentication properties of asymmetric encryption algorithms, which DH cannot achieve.
Done!
This article is synchronized and updated to xLog by Mix Space. The original link is https://www.vikifish.com/posts/security/why-we-need-dh-group