0

I'm trying to get my head around how DH and RSA are used in HTTPS. I'm sorry if this is a duplicate.

I've done research into what RSA and DH are, but I'm trying to figure out how they are used together in HTTPS.

So, I've read RSA handles authentication. It uses a private/public key pair and can authenticate a server.

DH is a key exchange algorithm, and DHE is DH, but the agreed upon secret is thrown away after a certain time.

Does RSA handle the authentication, and encrpts the DHE process of agreeing upon a shared secret with which futher communication will be encrypted? If so, is the reason DHE is used because it allows to throw away the shared secret? Why not continue to use the RSA key pair to encrypt communication instead of agreeing upon a shared secret?

This probably contains some misunderstands etc, I'm not to well versed in this.

Thanks for your time!

ptf
  • 109
  • 3
  • 1
    take a look at the Related questions on the side - I think they will answer all your questions: https://security.stackexchange.com/questions/90090/what-is-the-role-of-rsa-in-ecdhe-rsa?rq=1 – schroeder May 05 '17 at 14:43
  • 1
    The duplicate was set because of *"Why not continue to use the RSA key pair to encrypt communication instead of agreeing upon a shared secret?"*. As for not exchanging a key at all but just using RSA for encryption see [RSA maximum bytes to encrypt, comparison to AES in terms of security?](https://security.stackexchange.com/questions/33434/rsa-maximum-bytes-to-encrypt-comparison-to-aes-in-terms-of-security). – Steffen Ullrich May 05 '17 at 15:11
  • Thank you both of you, I think I understand now. RSA is used for authentication, and EDC is used because the amount of data RSA can encrypt is limited. – ptf May 08 '17 at 08:16
  • As well as extra security I see. https://security.stackexchange.com/questions/105731/why-is-key-exchange-necessary-at-all?noredirect=1&lq=1 – ptf May 08 '17 at 08:42

0 Answers0