Applied Cryptography
In TLS, which of the following key exchange methods provides the property that previously recorded communications cannot be decrypted even if the private key of the server certificate leaks later (forward secrecy)?
- AKey exchange such as ECDHE, which uses throwaway values created for each connection
- BA method in which the client encrypts the key material it created with the RSA public key of the server certificate and sends it
- CA method in which the server and client keep using the same symmetric key, agreed in advance, for every connection
Show answer and explanation
Answer: A. Key exchange such as ECDHE, which uses throwaway values created for each connection
The final E in ECDHE stands for ephemeral (throwaway): a new secret value is used for the key exchange of each connection and discarded afterwards. The private key of the certificate is used only for signing, so even if it leaks later, the shared secrets of past connections cannot be computed. By contrast, with the method of sending key material encrypted with the server's RSA public key, the recorded traffic plus a later-leaked private key allows all past communications to be decrypted. TLS 1.3 removed that method, and key exchange is now based on (EC)DHE with forward secrecy (except when a connection is resumed with a pre-shared key alone).
- A. Correct. The throwaway secret values are not kept, so past shared secrets cannot be recomputed.
- B. With RSA key transport, past communications can be decrypted once the private key leaks. It was removed in TLS 1.3.
- C. If the fixed key leaks, all past and future communications can be read.