Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In recent weeks the concept of (perfect) forward security/secrecy has been mentioned a lot, primarily in the context of the shocking revelations about NSA eavesdropping. As far as I'm aware, this concept was introduced by C. G. Günther in [1]. Unfortunately [1] only sketches the concept but does not give a security definition. The survey [2] gives a formal security definition only for forward secure pseudo-random generators. The textbooks [3, 4, 5, 6] all don't even mention the concept, and the relevant Wikipedia article is near unreadable.

Could somebody please point me towards a formal definition of (perfect) forward security/secrecy?

  1. C. G. Günther, "An Identity-based Key-exchange Protocol".
  2. G. Itkis, "Forward Security: Adaptive Cryptography: Time Evolution".
  3. J. Katz, Y. Lindell, "Introductin to Modern Cryptography".
  4. O. Goldreich, "Foundations of Cryptography".
  5. J. Hoffstein, J. Pipher, J. H. Silverma, "An Introduction to Mathematical Cryptography".
  6. D. R. Stinson, "Cryptography: Theory and Practise".
share|improve this question
up vote 2 down vote accepted

Do you have a specific application domain in mind? I do not know of any formal definition that spans multiple application domains.

A formal definition of Perfect Forward Secrecy for the domain of key exchange protocols is included in this paper:

Beyond eCK: Perfect Forward Secrecy under Actor Compromise and Ephemeral-Key Reveal

share|improve this answer
Thank you. My application is quite simple, I want to understand precisely what it means that e.g. Google is using perfectly forward secure encryption of my communications. I suspect that it does not mean much given the requirements of various legislations to store relevant meta-data. – Martin Berger Jun 28 '13 at 13:33
I agree, and I doubt that the formal definitions you will find will have any relation to the claims made by such companies. – user4621 Jun 28 '13 at 13:46
Possibly they mean shielding the communications from adversaries on the network; but of course on their servers your communication is in plaintext. Legislations for storing data/wiretapping are a very different threat model. I would guess that their statement simply means that they're using SSL/TLS in a Diffie-Hellman mode. – user4621 Jun 28 '13 at 13:48
Legisation has a direct effect on the applicability of the threat model. For example if session key have to be stored, as I belive they would have to in the UK, then a threat-model that assumes adversaries cannot get hold of ephemeral key material would be inappropriate. – Martin Berger Jun 30 '13 at 10:26
If the protocol stores the session key for law enforcement (or, say, encrypts it with the public key of law enforcement agencies and includes this in a transmission) then of course perfect forward secrecy is not satisfied wrt those agencies. – user4621 Jun 30 '13 at 12:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.