6

TL;DR - Are there any benefits to using static DH over ephemeral DH?

I'm reading about the differences between static DH & ephemeral DH and I am trying to think of one logical reason to use static(-static) DH over ephemeral(-ephemeral) DH.

My understanding of DHE is that it provides Forward Secrecy which is something we want, is it not? FS ensures that if the server private key were to get leaked past communication would be secure correct?

So why would we still want to use static DH? Are there any benefits to this? I would presume that computation is perhaps one factor?

SEJPM
  • 45,967
  • 7
  • 99
  • 205
  • 1
    @ShanChen (and other people viewing this question in the review queue): I have not mod-closed this question as a dupe, because at least to me it looks like this question asks about static-static vs ephemeral-ephemeral DH which is not covered by the referenced question and I consider the difference big enough to be worthwhile, but the link to the other question is still worthwhile to have around to complement this Q&A. Nethertheless if you think they're close enough to be duplicates go ahead and place your vote. – SEJPM Jul 10 '18 at 16:14

2 Answers2

6

So why would we still want to use standard DH? Are there any benefits to this?

  • The party / parties with the static key can just pre-compute their public DH key and thus save one scalar multiplication / exponentiation per key exchange.
  • If a static DH key is used, it can be used for identification, eg if you do an ephemeral agreement with a static key and you know that static key belongs to a given entity you can be sure you have a shared key with that entity voiding the need for a full-on signature scheme. In fact it's a modern trend to build handshakes / authenticated key agreement solely based on DH as a primitive without involving signature scheme, e.g. Signal Protocol and HMQV do this, this involves static-ephemeral DH for the authentication.
  • Elaborating on the previous point, technically you can issue X.509 certificates for static DH public keys and they should work with TLS (but good luck finding a CA doing that and a client supporting that). See RFC 5280 and RFC 3279.
  • Static DH also potentially saves on bandwidth, eg if both parties have cached each other's public DH key, they can just rederive the shared secret at any time and use that. This may matter if eg you are using smart-cards with tight bandwidth constraints.
  • Additionally static-static DH is used when you want repudiable, but sender-authentic public-key based encryption. That is if you don't want to do sign-then-encrypt because you don't want to sign, but you still want to assert that a message came from you. This is actually done by NaCl's cryptobox.
Community
  • 1
SEJPM
  • 45,967
  • 7
  • 99
  • 205
  • For static-(EC)DH in X.509 and TLS see also https://crypto.stackexchange.com/questions/19452/static-dh-static-ecdh-certificate-using-openssl and as linked there https://security.stackexchange.com/questions/44251/openssl-generate-different-type-of-self-signed-certificate – dave_thompson_085 Jul 11 '18 at 05:20
6

The "advantage" of static DH is that the server doesn't need to compute an exponentiation each time. This advantage is, however, not worth it, in the sense that the static DH problem is easier than the DLOG problem (to the best of our knowledge). In the paper The Static Diffie-Hellman Problem (PS) by Brown and Gallant, they show an attack on the static DH problem for Elliptic curves that is significantly faster than the best known for ephemeral DH.

Note: I would not call static DH "standard"; on the contrary, in my mind, ephemeral is the "standard" version.

SEJPM
  • 45,967
  • 7
  • 99
  • 205
Yehuda Lindell
  • 27,820
  • 1
  • 66
  • 83