+ Reply to Thread
Results 1 to 4 of 4
  1. Senior Member teancum144's Avatar
    Join Date
    Jun 2012
    Location
    Pacific Northwest, USA
    Posts
    227

    Certifications
    CISSP, CISA, CPA (inactive), Network+, Security+
    #1

    Default TLS Cryptographic Algorithm to Establish a Session Key

    Which of the following describes the cryptographic algorithm employed by TLS to establish a session key?
    A. Diffie-Hellman
    B. Blowfish
    C. RSA
    D. IKE

    The answer is A, but why couldn't it be C? According to the following sources, it can be either:
    Reply With Quote Quote  

  2. SS -->
  3. Senior Member teancum144's Avatar
    Join Date
    Jun 2012
    Location
    Pacific Northwest, USA
    Posts
    227

    Certifications
    CISSP, CISA, CPA (inactive), Network+, Security+
    #2
    In my continuing effort to understand why Diffie-Hellman is a better choice than RSA, I've done some research on how each performs key exchange.

    To understand Diffie Hellman key exchange better, I found the following excellent paper (thanks to paul78's post here: RSA vs Diffie-Hellman confusion):
    http://www.sans.org/reading_room/whi...-protocols_751

    To add to my understanding of Diffie-Hellman key exchange, I found the following excellent video:
    Public Key Cryptography: Diffie-Hellman Key Exchange - YouTube

    My understanding of Diffie-Hellman key exchange: Two non-private numbers (a large prime number and a base/generator number) are shared between two people. Each person selects a secret number (S1 and S2). From the shared numbers and his/her secret number, each person computes a public number (P1 and P2). Person 1 computes a new secret number (S3) using the Diffie-Hellman algorithm, the computed public numbers (P1 and P2), the the non-private shared numbers, and his/her original secret number (S1). Person 2 computes the same secret number (S3) using the Diffie-Hellman algorithm, the computed public numbers (P1 and P2), the the non-private shared numbers, and his/her original secret number (S2). The new secret number (S3) is the symmetric key. The magic of the Diffie-Hellman algorithm is that the symmetric key (S3) is never transmitted between the parties (some pretty amazing math!).

    RSA uses asymmetric keys via PKI to exchange symmetric keys.

    Now that I understand each key exchange method, I'm still unclear why Diffie-Hellman is a better answer than RSA. Here is another link that says you can use either:
    https://www.juniper.net/techpubs/en_...pic-42500.html
    Last edited by teancum144; 11-21-2012 at 06:20 PM.
    Reply With Quote Quote  

  4. Senior Member
    Join Date
    Feb 2012
    Posts
    2,426
    #3
    I'm glad you found my previous helpful.

    I have heard that some exams try to keep things very straight-forward. In this particular case, the question writer is probably keeping to the fact that DH is considered a key-exchange algorithm and RSA is a public-key cipher. RSA by-itself is actually not a key exchange algorithm. Sometimes, you just have to choose the answer that fits the body of knowledge prescribed by the organization.

    As for the specifics of TLS, if you really, really enjoy that level of detail , the best reference is the actual RFC - for TLS 1.2 - that would be RFC 5246 - RFC 5246 - The Transport Layer Security (TLS) Protocol Version 1.2. TLS as I understand the RFC does support the concept of using an RSA-encrypted secret. But bear in mind, RSA isn't actually the key-exchange, it is used to encrypt the symmetric key to pass from the client to server versus an actual key-exchange algorithm like DH where the symmetric key is derived by both parties.

    So if you think about the question which talks about "establishing a session key". With DH - as you noted - the symmetric key is never transmitted. But with RSA - it has to be encrypted and transmitted.

    It could be argued that if the question writer said "which encryption algorithm" or "which asymmetric algorithm" then RSA would be the better answer since DH is not an encryption algorithm.

    Wow - you really are getting into the nitty-grity if you are studying for the Sec+. I don't actually know much about Sec+ but I bet you are going to do great!
    Reply With Quote Quote  

  5. Senior Member teancum144's Avatar
    Join Date
    Jun 2012
    Location
    Pacific Northwest, USA
    Posts
    227

    Certifications
    CISSP, CISA, CPA (inactive), Network+, Security+
    #4
    Quote Originally Posted by paul78 View Post
    TLS as I understand the RFC does support the concept of using an RSA-encrypted secret. But bear in mind, RSA isn't actually the key-exchange, it is used to encrypt the symmetric key to pass from the client to server versus an actual key-exchange algorithm like DH where the symmetric key is derived by both parties.
    Ironically, RSA is exchanging a session (symmetric) key, whereas DH is "establishing" (or creating) a session key - which is the point you are making in the following quote:
    Quote Originally Posted by paul78 View Post
    So if you think about the question which talks about "establishing a session key". With DH - as you noted - the symmetric key is never transmitted. But with RSA - it has to be encrypted and transmitted.
    In the preceding quote, I think you nailed it by focusing on the word "establishing" as opposed to to "exchanging".
    Quote Originally Posted by paul78 View Post
    It could be argued that if the question writer said "which encryption algorithm" or "which asymmetric algorithm" then RSA would be the better answer since DH is not an "encryption algorithm."
    Actually, the question does ask which "cryptographic" algorithm, which can be interpreted as any method to to secure communications (or make communications secret) - including encryption (RSA) or establishing a session key (Diffie-Hellman).

    Sorry for over-analyzing your post, but it really helps me to hammer the concepts into my brain. Your analysis is, as always, very insightful and very helpful. Thanks!!
    Reply With Quote Quote  

+ Reply to Thread

Social Networking & Bookmarks