The IETF plans to drop RSA from TLS 1.3, key exchange algorithms that ue ephemeral keys are expected to now become the norm. This comes in the wake of several service providers adopting strategies to strengthen their infrastructure for stronger security. Data privacy has now become a major delivery point with deprecated encryption mechanisms being dropped, adoption of perfect forward security, greater key lengths and multi factor authentication. Forward security makes it harder to decrypt future and past conversations by using a one-time session key. This is made available by DHE (Diffie-Hellman Exchange) and ECDHE (Elliptic Curve Diffie-Hellman key exchange).
Key exchange and management present the greatest challenges in the creation of a reliable encryption infrasturcuture. For a long time, RSA has remained the most effective solution for exchanging session keys. Through RSA, the server maintains possession of the private key for decryption, end-points which require to communicate with the server only need the public key to encrypt data. But recent events have shown that it is sufficiently trivial for well funded organizations to gain access to a server’s private key. This undermines the trust created between the server and client. Ability to use ephemeral keys is therefore going to mitigate this to a large extent.
RSA has been in use on the TLS code-base since SSL 2.0. Several setbacks have however contributed to its deprecation in the ciphersuite. According to Matthew Green, a cryptographer at John’s Hopkins, dropping RSA from TLS can be attributed to Snowden who has improved data privacy on the internet. Internet security still has the challenge of implementation bugs which has affected various systems in recent times.
