Post-Compromise Security and Backward Security seem to mean that the attacker has obtained the communication key between two parties or groups in the current state, but cannot further obtain subsequent keys. What is the specific difference between them?
As discussed in the book Real-World Cryptography by David Wong, post-compromise security (PCS) and backward secrecy/security refer to the same thing. It's also called future secrecy, break-in recovery, healing, and prediction resistance, as mentioned in Crypto Dictionary by Jean-Philippe Aumasson.
I would argue post-compromise security is the best of the terms as backward/future secrecy are easy to confuse with forward secrecy, and the others are a bit vague. Furthermore, it explains the 'healing' capabilities of a protocol after a compromise.
Following the example of a PRNG in the book:
- Post-compromise security: A compromise of the state does not allow future random numbers to be predicted.
- Forward secrecy: A compromise of the state does not allow previously generated random numbers to be recovered.
You'll notice that backward secrecy and forward secrecy sound the wrong way around. Post-compromise security at least clarifies one direction.
It's easier to obtain forward secrecy generally speaking. For example, compromising a state in a symmetric key ratchet could allow all future keys to be derived:
As a related aside, there was a paper recently that discusses how TMTO attacks can be applied to the TLS 1.3 key update/Signal protocol symmetric key ratchet because they can be modelled as non-additive synchronous stream ciphers. When a state is found, an attacker can derive all the future states. Because the state size is not double the key size, the protocol security level is reduced, with the amount depending on the number of updates/ratchets.
In addition to the existing answer, those two terms mean essentially the same thing in the context of Authenticated Key Exchange protocols. Post-compromise security was the term used by Cohn-Gordon, Cas Cremers, and Garratt when they set to formalize this security property that had been informally referred to as "backward security" or "self-healing".
The term backwards security appears in other contexts like searchable encryption, capturing something "similar" in spirit, but post-compromise security isn't widely used in that space.