Diffie-Hellman vs RSA Key Establishment Algorithms

350-701 By islever Editorial Last updated

Describe cryptography security components such as hashing, encryption, PKI, SSL, TLS, QUIC, MASQUE, IPsec, NAT-T IPv4 for IPsec, preshared key, certificate-based authorization, and post-quantum cryptography

Short answer

B DH is an asymmetric key establishment algorithm intended to output symmetric keys.

Question

When choosing an algorithm to use. what should be considered about Diffie Heilman and RSA for key establishment?
  1. RSA is a symmetric key establishment algorithm intended to output asymmetric keys.
  2. DH is an asymmetric key establishment algorithm intended to output symmetric keys. Correct Answer
  3. DH is a symmetric key establishment algorithm intended to output asymmetric keys.
  4. RSA is an asymmetric key establishment algorithm intended to output symmetric keys.

Key Takeaways

The core trap is confusing the nature of the algorithm (asymmetric) with the nature of the resulting key (symmetric). Students often misclassify DH as symmetric because it produces a shared secret, or misclassify RSA's output.

This question tests the fundamental distinction between Diffie-Hellman and RSA algorithms in cryptography. It establishes that DH is an asymmetric algorithm used to establish symmetric keys, while RSA is an asymmetric cryptosystem primarily for encryption or signing.

Common mistake: Many candidates select Option D, believing RSA is an asymmetric algorithm that outputs symmetric keys. This is incorrect because RSA keys themselves are asymmetric (public/private pairs), not symmetric.

Expert Analysis

Why the Answer Is Correct

Option B is correct because Diffie-Hellman (DH) is fundamentally an asymmetric key agreement protocol. Its purpose is to allow two parties to generate a shared secret over an insecure channel. This shared secret is a symmetric key, which is then typically used with symmetric ciphers like AES for bulk data encryption. Therefore, DH is an asymmetric algorithm intended to output symmetric keys.

Why the Other Options Are Wrong

Option A is incorrect because RSA is not a symmetric algorithm; it is asymmetric. Furthermore, RSA does not "output" asymmetric keys in the context of establishment; it uses them. Option C is wrong because DH is not a symmetric algorithm; the exchange mechanism relies on public/private key mathematics. Option D is incorrect because while RSA is an asymmetric algorithm, it does not establish symmetric keys directly as its primary function in this context; it encrypts data or signs hashes using asymmetric keys. The phrase "intended to output symmetric keys" applies to the result of the DH exchange, not RSA operations.

Community Comment Notes

Community consensus strongly favors Option B. Users highlight that DH generates a shared secret (symmetric key) despite being an asymmetric protocol. Comments clarify that RSA is a cryptosystem using asymmetric keys, making options suggesting it outputs symmetric keys misleading or incorrect in this specific framing. One commenter noted that DH is often confused due to its output, but the algorithmic classification remains asymmetric.

Exam Strategy

When analyzing cryptographic algorithms, always separate the 'algorithm type' (how keys are managed) from the 'key type' (what is produced/used). Remember: DH = Asymmetric Algorithm -> Symmetric Key. RSA = Asymmetric Algorithm -> Asymmetric Keys (for encryption/signing).

Frequently Asked Questions

Why is DH called asymmetric if it creates a symmetric key?

DH is classified as asymmetric because it uses public and private key pairs during the exchange process. However, the final shared secret it produces is a symmetric key used for encryption.

Can RSA be used to establish symmetric keys?

RSA can encrypt a symmetric key, but it is not a key establishment protocol in the same way DH is. RSA operates entirely with asymmetric keys for both encryption and decryption/signing.

More 350-701 FAQ →

Discussion 11 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 11

  1. Vlad_Is_Love_ua 👍 3 Answered B
    Answer is B. RSA is not algorithm, it's cryptosystem. Meanwhile, DH is asymmetric algorithm to generate key for symmetric communication.
  2. fukumoto0925 👍 3
    It is actually B＊
  3. sull3y 👍 2
    D. Diffie-Hellman (DH) is a key agreement protocol that enables two parties to establish a shared secret key over an insecure communication channel. It is considered a key-establishment or key-agreement algorithm. RSA, on the other hand, is a public-key encryption algorithm that is often used to encrypt and digitally sign data. It is considered an asymmetric algorithm, as it uses two different keys, one for encryption and one for decryption. It is not intended to output symmetric keys, but it is often used to encrypt symmetric keys and then exchange them securely
  4. CCNP21 👍 2 Answered B
    Diffie Hellman uses a private-public key pair to establish a shared secret, typically a symmetric key. DH is not a symmetric algorithm – it is an asymmetric algorithm used to establish a shared secret for a symmetric key algorithm. https://doubleoctopus.com/security-wiki/encryption-and-cryptography/diffie-hellman-algorithm/
  5. fukumoto0925 👍 2
    It is actually . Read th whole answer (RSA is an asymmetric key establishment algorithm intended to output symmetric keys.). RSA keys are ASYMMETRIC, so that is the reason why it is not D
Show 6 more comments
  1. NoUserName1234 👍 2
    I would go for 'B': https://crypto.stackexchange.com/questions/42180/whats-the-difference-between-rsa-and-diffie-hellman
  2. b7f3562 👍 1 Answered B
    Answer is B. Omar Santos SCOR Official Cert pg 220 The interesting thing about DH is that although the algorithm itself is asymmetric, the keys generated by the exchange are symmetric keys that can then be used with symmetric algorithms such as Triple Digital Encryption Standard (3DES) and Advanced Encryption Standard (AES).
  3. Demon_Queen_Velverosa 👍 1
    Don't get confused by these two people. The answer is B as that is what DH is. yet D gets the asymmetric correct, these two did not read the part at the end of d that says it established symmetric keys
  4. XBfoundX 👍 1 Answered B
    RSA cannot be choosen, because it provide public and private key pair, DH provide in the end a symmetric key, so the proper answer is B.
  5. Ed1976 👍 1 Answered D
    RSA is Asymetric Alg.
  6. diverjim64 👍 1 Answered B
    OCG p. 86

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

What Is a Feature of an Endpoint Detection and Response Solution?

S-grade

Which Two Methods Belong in an AAA Authentication Method List?

S-grade

Preventing Unauthorized DHCP Servers on Cisco Switches

S-grade

What Is Considered a Cloud Data Breach in Cisco 350-701?

S-grade

← Back to 350-701 Study Guide