Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Every time I encounter the concepts of PFS (perfect forward secrecy) and wPFS (weak perfect forward secrecy), I feel uncertain about them.

My understanding is that:

  • PFS ensures that, if the parties' long-term keys have compromised in the future by an active adversary, he cannot calculate the session key.
  • wPFS ensures that, if a passive adversary has learned the private keys of both peers to the session, and if the session is "clean", he still cannot recover the session key.

I'm not sure whether my understanding is right or not. And I don't know the if these are the correct definitions of PFS and wPFS.

Can you help me understand PFS and wPFS?

share|improve this question

1 Answer 1

The difference between weak and strong perfect forward secrecy lies in the capabilities of the attacker. Perfect forward secrecy is strong if it remains secure in the face of an active attacker, while weak perfect forward secrecy's security claim only covers passive attackers.

If I'm not mistaken weak perfect forward secrecy (wPFS) is a term introduced to claim perfect forward security for a 2-message protocol, disregarding MITM attacks.

A quick Google search revealed that this term was probably coined by Hugo Krawczyk in his 2005 paper HMQV: A High-Performance Secure Diffie-Hellman Protocol.

I don't know how commonly understood this term is however, so if you're intending to use it for a paper make sure to explain it.

share|improve this answer
what's the purpose of defining PFS and wPFS? why that? Why are many key-exchange protocols designed to meet wPFS or PFS? –  T.B Sep 11 '13 at 23:42
I just explained the answer to your first question - to distinguish between a security claim against a passive and an active attacker. The reason why key-exchange protocols are designed to be (w)PFS is because the property is so desirable: even if the key leaks your previous communications are still safe. –  orlp Sep 11 '13 at 23:45
@T.B I don't know - I do not have access to that specification (and I'm not going to pay for it, sorry). –  orlp Oct 28 '14 at 13:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.