I am getting confused with RSA, Diffie-Hellman Key Exchange, PKI and X.509v3.

I took a look of RSA's mathematics algorithm, it seems like a encryption algorithm, right? Generating public key and private key, using for encryption and decryption...

Also, I took a look of Diffie-Hellman's mathematics algorithm, it seems just like a key exchange, right? Each side can calculate the same key by using some kinds of algorithm. It seems not a encryption, right?

I have also took a look of PKI, there are something new which is the CA and digital certificate. Public key and private key are also mentioned.

So, what is the relationship between these concepts? Are they 3 separated concepts? Or they will be used together in the reality?

Also, is X.509 the standard of PKI? So PKI itself is not a standard?

This is the questions that I have confused for a very long time. Thanks all of you.


RSA is two algorithms, one for asymmetric encryption, the other one for digital signatures. They use the same kind of keys, they share the same core operation, and they are both called "RSA".

Diffie-Hellman is a key exchange algorithm; you can view it as a kind of asymmetric encryption algorithm where you do not get to choose what you encrypt. This is fine for key exchange, where you just want to obtain an essentially random shared secret between two people. Note that most usages of RSA asymmetric encryption, in practice, are also key exchange, e.g. in SSL/TLS: the client generates a random value, encrypts it with the server's public key, and send it to the server.

PKI is a concept. It builds on the notion of certificate: a certificate is an assertion of key ownership. Basically, a certificate is an object that contains an identity (a name) and a public key, and the object is digitally signed (e.g. with RSA -- the signature algorithm -- or ECDSA). A certificate is validated by verifying this signature. The idea is that if I know the public key of whoever issued (signed) the certificate, then I can verify that signature, and thereby gain some confidence in the fact that the public key contained in the certificate really belongs to the entity designated by the identity contained in the certificate.

When you organize certificates in a way such that there is a strict hierarchy, where certificate issuers are called Certification Authorities and issue certificates to each other, with a handful of top-CA called "root CA", then that overall structure is called a Public Key Infrastructure, i.e. a PKI.

X.509 is a standard for the format and contents of certificates. X.509 is rather open about what signature algorithms will be used for signing certificates, but in practice, 99% of the time, it will be RSA.

  • Thanks for your answers. I feel much clear right now. In PKI, we always say that encrypt with public key and decrypt with private key. Actually, is RSA always be the methodology? Such as generating key for encryption and decryption. Also, X.509 is the standards that defined the format and content of digital certificate such as issuer, serial number or version, etc? Would you mind to explain more about diffie-hellman key exchange? How it actually apply in reality and operate with RSA and PKI? Thanks you very much, I am really grateful. – alcohol menthol Feb 5 '15 at 11:50

Your Answer

