Can you help me understand PFS and wPFS?

Question

Every time I encounter the concepts of PFS (perfect forward secrecy) and wPFS (weak perfect forward secrecy), I feel uncertain about them.

My understanding is that:

• PFS ensures that, if the parties' long-term keys have compromised in the future by an active adversary, he cannot calculate the session key.
• wPFS ensures that, if a passive adversary has learned the private keys of both peers to the session, and if the session is "clean", he still cannot recover the session key.

I'm not sure whether my understanding is right or not. And I don't know the if these are the correct definitions of PFS and wPFS.

Can you help me understand PFS and wPFS?

Answer 1

The difference between weak and strong perfect forward secrecy lies in the capabilities of the attacker. Perfect forward secrecy is strong if it remains secure in the face of an active attacker, while weak perfect forward secrecy's security claim only covers passive attackers.

If I'm not mistaken weak perfect forward secrecy (wPFS) is a term introduced to claim perfect forward security for a 2-message protocol, disregarding MITM attacks.

A quick Google search revealed that this term was probably coined by Hugo Krawczyk in his 2005 paper HMQV: A High-Performance Secure Diffie-Hellman Protocol.

I don't know how commonly understood this term is however, so if you're intending to use it for a paper make sure to explain it.

Answer 2

In addition to the above answer, Cremers and Feltz elaborate on the distinction further in their paper:

One important property of KE protocols that is not guaranteed by the eCK security model is perfect forward secrecy (PFS). This property holds if an adversary cannot learn the session-keys of past sessions, even if he learns the long-term secret keys of all the parties. The designers of the eCK model argued that this property cannot be achieved by two-message KE protocols, based on [13]. In particular, in [13, p. 15], Krawczyk sketched a generic PFS attack, for which he claimed that it breaks the security of any implicitly authenticated two-message KE protocol. In the attack, the adversary actively interferes with the communication between the parties by injecting self-constructed messages. This enables him to compute the used session-key if he later learns the long-term secret keys of the parties. To prove a slightly weaker notion of forward secrecy for the HMQV protocol, Krawczyk introduced the notion of weak perfect forward secrecy (weak-PFS). When the long-term keys are compromised, weak perfect forward secrecy guarantees secrecy of previously established session-keys, but only for sessions in which the adversary did not actively interfere.

Answer 3

I think wPFS is absurd. They describe wPFS attack scenario as below in their paper. [Beyond eCK: Perfect Forward Secrecy under Actor Compromise and Ephemeral-Key Reveal? Version 2.0, 19 October 2017] page 4

The adversary, impersonating party $\hat A$, generates a random value x and sends $g^x$ to a responder session at party $\hat B$. $\hat B$ responds by sending $g^y$ and computes the session key. The adversary chooses $\hat B$'s session as the test-session, i.e. the session under attack, and reveals $\hat A$’s long-term secret key after $\hat B$’s session ends. Now the adversary can simply follow all protocol steps that an honest party $\hat A$ would have performed using x and $\hat A$'s long-term secret key. In particular, the adversary can compute the same session-key as the test-session, violating PFS.

If $\hat A$'s long term secret key is compromised, the adversary could disguise as $\hat A$ until $\hat A$'s certificate is revoked. what kind of other attacks do you need? Although some protocols defend these attacks(property full PFS), but these protocols cannot defend against what an attacker disguise as $\hat A$.