Subject: RE: Ephemeral RSA (was Re: [TLS] Any advice regarding frequency ofgenerating)

From: "Whyte, William" <[email-masked]>
Date: Tue, 19 Dec 2006 13:46:04 -0500

RSA keys take a long time to generate, so it's not clear that this
would have any significant advantages over ephemeral DH.

William 

> -----Original Message-----
> From: Mike [mailto:[email-masked]] 
> Sent: Tuesday, December 19, 2006 6:10 PM
> To: [email-masked]
> Subject: Ephemeral RSA (was Re: [TLS] Any advice regarding 
> frequency ofgenerating)
> 
> > RSA ephemeral is not "prohibited".  Is not standardized, thats true.
> 
> It would be easy to define a hello extension to add ephemeral RSA.
> The client would send the extension indicating that it would accept
> an ephemeral RSA key, and the server would respond with the same
> extension in the server hello indicating that it will send a server
> key exchange message with the key.  This would avoid the need to
> define new cipher suites for ephemeral RSA.
> 
> Mike
> 
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/tls
> 

_______________________________________________
TLS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tls

---

From: Martin Rex <[email-masked]>
Date: Tue, 19 Dec 2006 22:08:11 +0100 (MET)

> would have any significant advantages over ephemeral DH.

One of the advantages is that the code is already there and most
of it interoperability tested because the RSA_EXPORT key exchange
method requires an ephemeral RSA keypair for use with certs
that have RSA keys >512 bits.

There is no requirement to generate a new ephemeral RSA keypair on every
SSL handshake.  It should be perfectly sufficient for a TLS server
to re-generate an ephemeral keypair out-of-band like once per hour.

SSHD in daemon mode uses a similar approach.

-Martin