Lightboard Lessons: Perfect Forward Secrecy

@Piotr, sorry for the delay in answering your questions...but here's my take:

ECDHE and DHE are both "Diffie Hellman" key exchanges. The "E" part, by the way, simply refers to the keys being Ephemeral...or, short lived. That is, a new key is generated for every session rather than using the same one for a long period of time. The primary difference between DH and ECDH is that DH uses a multiplicative group of integers while ECDH uses a multiplicative group of points on an elliptic curve. But, both of these use the Diffie Hellman algorithm to exchange keys. As it turns out, using points on an elliptic curve allows the algorithm to run much faster than using groups of large integers. So, that's why ECDH is much faster than just normal DH. Ultimately, the Diffie Hellman key exchange algorithm leads you to a master key (shared, symmetric key) that is used for bulk encryption. It doesn't matter if you use ECDH or normal DH...either one leads to the shared, symmetric key. Most people prefer ECDH because it's so much faster than normal DH.

The RSA part of all of this is the authentication that you mentioned in your comment. Something has to be used to verify that the server is actually the correct server, and the RSA algorithm is used to do that. One of the confusing parts about all of this is that RSA can also be used for key exchange as well (although, most people don't use RSA for key exchange any more). But, regardless, RSA is used for server authentication.

Last, the naming convention for the cipher suites is best tracked by using the hexadecimal value associated with each suite. I captured a Client Hello and Server Hello for a test web application I have. I'm using BIG-IP v12.0 for this, and I have the DEFAULT cipher suite enabled for my client SSL profile. Here's the Wireshark capture for the Client Hello:

Notice that the browser sends 15 different cipher suites to the server for consideration. Each cipher suite has a hexadecimal value listed to the right of the cipher suite. Keep an eye on cipher suite hex value 0x0039. This will be the one that is ultimately selected by the BIG-IP for this session. Here's the Server Hello Wireshark capture that happened right after the Client Hello:

Notice that the BIG-IP (Server) chose the cipher suite with hexadecimal value 0x0039. The Wireshark capture does a good job of letting you know what's in the cipher suite (TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x0039)), but that doesn't always correspond exactly to the naming convention of the BIG-IP list of cipher suites. Here's a list of the DEFAULT cipher suites on my BIG-IP:

Notice that the naming convention is a little different here. So, in order to correspond the Wireshark list of cipher suites to the BIG-IP list, you should use the hexadecimal value. Unfortunately, the BIG-IP doesn't list the hexadecimal value of the cipher suites by default, but you can cross-reference them using this link: https://support.f5.com/csp/article/K13156. Here's a screenshot of the BIG-IP version 12 cipher suites (notice that the hexadecimal values are listed for each one). And, I circled the 0x0039 so you could track the same cipher suite that was used throughout this session.

I hope this helps! Let me know if you have any other questions!

Hi John,

Great explanation, I really appreciate time and effort!

Piotr

Hi. thanks for you kind lesson. Recently, my customers want to use PFS. However, to use PFS, we need to use DHE or ECDHE. and the Cipher usually has a lower performance than RSA. In fact, the problem I'm having is: For i-Series, see the datasheet. ECC performance is specified, but existing BIGIP series does not have such data. I have to explain how there is some performance degradation when using Cipher for PFS, but I have difficulty because there is no rough guide. I would really appreciate it if you could help. happy new year

Hi swjo...great question! The specs that F5 provides for SSL TPS is for hardware. As an example, the 12250v has specialized hardware for RSA, but not for ECC. You can still use ECC ciphers in version 11.4+ regardless of hardware platform, but the processing of the ECC ciphers is done in software except on our newer platforms that have ECC-specific hardware. Our new i-Series platforms all have specific hardware for ECC (and they still have hardware for RSA as well). The reason that the other platforms don't list the ECC-specific SSL TPS numbers is that ECC is done in software for those specific platforms and the numbers will vary greatly depending on CPU utilization, etc.

As a point of comparison, the i10800 platform is comparable to the 12250v but it has ECC specific hardware, and it is rated at 48K TPS (using ECDSA P-256). More specifically, it used the ECDHE-ECDSA-AES128-SHA256 cipher string for testing.

I hope this helps.