> For a discussion of ephemeral RSA vs. ephemeral DH: I don't know. When > switching from SSH-1 to SSH-2, RSA session keys were replaced with DH > ones, but that may have been for patent reasons. Maybe somebody else > can spread mor light on this point.
There's a bit of a discussion in _SSL and TLS_. As I understand the issues (I just skimmed the sections), with ephemeral DH you can generate a new key inexpensively. Probably something as simple as generating a very large random number X and computing g^x mod p (where g and p are specified in the DH parameter file). This means you can generate a new key for every session, providing maximum security (short of regenerating the DH *parameters* every time!) In contrast, RSA keys have to be regenerated every time. That's expensive, so implementations will typically cache the key and reuse it for a while. This puts all of those sessions into the same boat, securty-wise. There's are also some efficiency considerations since the private and public keys in RSA tend to be about the same size, while DH keys (I think) tend to have much smaller private keys, I think it's a fixed size of something like 80 or 128 bits. (I know this is the case with DSA, but I'm not 100% sure about DH.) This smaller private makes some operations more efficient without compromising security. Bear ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
