3 ms·
Generating dhparams every time is very expensive - it involves finding large prime which can take some time. ECDHE requires only to generate random N-bit number
by mmozeiko 11y ago
Generating dhparams every time is very expensive - it involves finding large prime which can take some time. ECDHE requires only to generate random N-bit number (any number) which is pretty much instant operation.
- tptacek 11y agoThat's because with ECDHE you're accepting a much more extensive set of static parameters.
- agwa 11y agoYou're conflating private keys and parameters. The random number that ECDH requires you to generate is the private key, just as FFDH requires you to generate a random private key (which is also fast). If you were actually generating your own random curves (which TLS doesn't allow) it would be much more expensive.