4 ms·
How does this architecture address PFS? I'm guessing a future version would require the exchange of DH private key to make it work...
by yusyusyus 12y ago
How does this architecture address PFS? I'm guessing a future version would require the exchange of DH private key to make it work...
- agwa 12y agoNothing that complicated is required. When the server needs to sign the DH handshake, it sends the value to be signed over to the key server, and the key server replies with the signature. Although the diagrams in the blog post show the non-PFS RSA handshake, I'm sure the architecture already supports the PFS DH handshake too.