Explain the three versions of Diffie-Hellman used in SSL/TLS

Question

I understand how Diffie-Hellman algorithm can be used to agree on a common key between a client and server. I am struggling to understand the three variations of Diffie_Hellman - Anonymous Diffie-Hellman, Fixed Diffie-Hellman and Ephemeral Diffie-Hellman. Is DHE used along with AES for forward secrecy ? Can someone explain what these variations are and how they are used in TLS ?

Answer 1

These three variants of Diffie-Hellman all operate in roughly the same way. In all three, the client and the server pick a random number (private key), compute a value (their public key) based on that random number, and then share that public key with the other side.

In anonymous Diffie-Hellman, neither side signs or otherwise authenticates their public key. As a result, you can determine that you computed a shared secret with somebody, but not who that party is. This leaves you vulnerable to a man-in-the-middle attack. Usually this is also an ephemeral key exchange.

In fixed Diffie-Hellman, one side (usually the server) presents their public key in a certificate (usually signed by a certificate authority). If this is a signed certificate, then the fact that owner of the certificate can negotiate a successful connection is proof that it controls the key and therefore authenticity is established. However, because this key is fixed in a certificate, if the corresponding private key is leaked, all data generated using that key is compromised.

In ephemeral Diffie-Hellman, both sides generate a new, random public and private key each time. The server (and the client, if they are authenticated) signs their Diffie-Hellman public key with the private key in the server certificate (which is usually RSA or ECDSA). The fact that both sides can negotiate a connection successfully and the Diffie-Hellman public key is signed proves authenticity of the connection. An attacker impersonating the server would be limited to reusing a previous signed DH public key sent by the server, but because it did not know the private key, it couldn't successfully negotiate a connection. Because the Diffie-Hellman key material is fresh each time, as long as both sides discard their Diffie-Hellman private key when the connection is done, this provides perfect forward secrecy.

Anonymous Diffie-Hellman is not practically used these days since it provides no authentication. For situations where authentication is not important, using a self-signed certificate is almost as easy. Fixed Diffie-Hellman is not practically used in TLS because ephemeral Diffie-Hellman provides perfect forward secrecy and using that with an RSA or ECDSA certificate is easier and better supported. However, fixed Diffie-Hellman remains useful in situations where the protocol is not online and thus ephemeral options are more difficult.

Much of this also applies to other protocols, such as SSH. However, in the SSH protocol, the signature is not over the public key, but over a hash of the negotiated secret. This is also a secure approach and also provides perfect forward secrecy.