Re: [TLS] DHE key derivation

[[e-mail] (Martin Rex)]

Michael D'Errico wrote:
> Yaron Sheffer wrote:
> > While we're opening (maybe) the negotiation of DHE, I'd like to clarify 
> > an issue that bothers me in the implementation of DHE in TLS:
> > 
> > With DHE, the premaster secret depends only on the DH shared secret. We 
> > know that DHE is commonly used with 1024-bit parameters. So even if you 
> > have a 2048-bit RSA certificate, the session strength will be 1024 bits.
> > 
> > What if we mixed *both* the DH secret and the regular encrypted nonce 
> > that's used in RSA ciphersuites into the premaster secret? Wouldn't we 
> > get forward secrecy, as well as crypto strength equivalent to the higher 
> > of the two lengths?
> 
> In DHE_RSA, RSA is used in signature mode to sign the DH parameters.
> It is not recommended to use the same RSA key for both signing and
> key encipherment.

Isn't that (using the same RSA key for both signing and key encipherment)
what pretty much all TLS Servers do when they support both,
traditional RSA ciphersuites plus DHE_RSA and/or ECDHE_RSA?

-Martin