Every time I encounter the concepts of PFS (perfect forward secrecy) and wPFS (weak perfect forward secrecy), I feel uncertain about them.

My understanding is that:

  • PFS ensures that, if the parties' long-term keys have compromised in the future by an active adversary, he cannot calculate the session key.
  • wPFS ensures that, if a passive adversary has learned the private keys of both peers to the session, and if the session is "clean", he still cannot recover the session key.

I'm not sure whether my understanding is right or not. And I don't know the if these are the correct definitions of PFS and wPFS.

Can you help me understand PFS and wPFS?


The difference between weak and strong perfect forward secrecy lies in the capabilities of the attacker. Perfect forward secrecy is strong if it remains secure in the face of an active attacker, while weak perfect forward secrecy's security claim only covers passive attackers.

If I'm not mistaken weak perfect forward secrecy (wPFS) is a term introduced to claim perfect forward security for a 2-message protocol, disregarding MITM attacks.

A quick Google search revealed that this term was probably coined by Hugo Krawczyk in his 2005 paper HMQV: A High-Performance Secure Diffie-Hellman Protocol.

I don't know how commonly understood this term is however, so if you're intending to use it for a paper make sure to explain it.

| improve this answer | |
  • $\begingroup$ what's the purpose of defining PFS and wPFS? why that? Why are many key-exchange protocols designed to meet wPFS or PFS? $\endgroup$ – T.B Sep 11 '13 at 23:42
  • 1
    $\begingroup$ I just explained the answer to your first question - to distinguish between a security claim against a passive and an active attacker. The reason why key-exchange protocols are designed to be (w)PFS is because the property is so desirable: even if the key leaks your previous communications are still safe. $\endgroup$ – orlp Sep 11 '13 at 23:45
  • $\begingroup$ @T.B I don't know - I do not have access to that specification (and I'm not going to pay for it, sorry). $\endgroup$ – orlp Oct 28 '14 at 13:04
  • $\begingroup$ @orlp: eprint.iacr.org/2005/176.pdf $\endgroup$ – Savara Dec 8 '15 at 17:01

In addition to the above answer, Cremers and Feltz elaborate on the distinction further in their paper:

One important property of KE protocols that is not guaranteed by the eCK security model is perfect forward secrecy (PFS). This property holds if an adversary cannot learn the session-keys of past sessions, even if he learns the long-term secret keys of all the parties. The designers of the eCK model argued that this property cannot be achieved by two-message KE protocols, based on [13]. In particular, in [13, p. 15], Krawczyk sketched a generic PFS attack, for which he claimed that it breaks the security of any implicitly authenticated two-message KE protocol. In the attack, the adversary actively interferes with the communication between the parties by injecting self-constructed messages. This enables him to compute the used session-key if he later learns the long-term secret keys of the parties. To prove a slightly weaker notion of forward secrecy for the HMQV protocol, Krawczyk introduced the notion of weak perfect forward secrecy (weak-PFS). When the long-term keys are compromised, weak perfect forward secrecy guarantees secrecy of previously established session-keys, but only for sessions in which the adversary did not actively interfere.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.