🚀 go-pugleaf

In article <1993Jan4.160546.11746@Princeton.EDU> dla@athena (Don Alvarez) writes:
>Digital signatures won't solve the problem Robert is posing.  The
>problem is how do two parties transition from an initial state of
>having no way to communicate securely to a final state of having a way
>to communicate securely.

Well yes, if you phrase the problem that way, you're quite right. But
I interpreted the question as dealing specifically with the
Diffie-Hellman key transfer phase, as it implied that D-H was useless.
It's not, as long as you have the necessary verified public keys to
verify your D-H exchanges.

By the way, I find the D-H/RSA hybrid *very* interesting because it
only uses RSA for signing -- not encryption. So the compromise of your
RSA secret key can, at worst, allow someone else to pretend to be you
in the future (assuming, of course, you aren't able to revoke your key
in time). It *cannot* compromise anything encrypted with an old
session key that was generated with the protocol, used and then
destroyed. A very useful property.

This scheme also has the advantage that it need not use RSA -- any
digital signature scheme will work. E.g., *if* the NIST DSS were to
become a freely usable, secure digital signature scheme, then you
could use it instead of RSA to sign your D-H exchanges. And since the
patent on Diffie-Hellman expires in 1997 while the patent on RSA
expires in 2000, you'd be able to freely use this combination three
years sooner than something based on RSA.

Phil