4 ms·
I don't see what you mean with d). For ECDHE_RSA you still need your high value certificate key online to sign your public Diffie-Hellman parameter. Or do want
by Perseids 12y ago
I don't see what you mean with d). For ECDHE_RSA you still need your high value certificate key online to sign your public Diffie-Hellman parameter. Or do want to presign a few thousand of them and use them one after another in normal handshakes?
- ctz 12y agoSorry, I was confusing this with something else (ECDH_RSA suites, where you can achieve decent levels of forward secrecy by signing a new ECDH key offline every minute or so). All ECDHE_ suites need the high value key to be online at all times, because the signed data includes per-handshake values.