Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
In the case where I am self-signing my digital certificates, if I just change my certificate (generate a new one) every week or month, will this have (sort of similar to) the same effect as implementing Forward Secrecy, since I should have a new private key every time?
Please correct me if I'm mistaken.
Thanks.
This only works if you are absolutely certain that you're properly erasing the old private keys. This is harder than it seems; you have to be sure that you're leaving no traces anywhere, including on backup media or scattered around your hard drive. With proper forward secrecy methods, the keys never leave RAM, which makes erasing them securely much, much easier. Furthermore, this only happens after a week or a month or whatever; if you erase the private certificate monthly, then an attacker who acquires the certificate at the very end of the month (before you erase it) can decrypt the whole months' worth of messages.
There is very little reason to do this. ECDHE is not slow; while it's a bit slower and more computationally intensive than RSA, that difference shrinks rapidly as security increases (at 2048-bit RSA keys, there's a very small difference). Furthermore, ECDHE does not have anywhere near as many implementation pitfalls as securely erasing a private certificate weekly, and doesn't leave the week- or month-long interval for private key theft. Just use ECDHE.
