2
$\begingroup$

Some time has passed since PFS introduction and we now have secure&proven asymmetric ciphers that can generate strong keys very efficiently (elliptic RSA variants and/or QD-Mceliece can generate 128-bit-equivalent-secure keys in milliseconds), so I'd like to implement some of them into some software I'm writing here.

Question: Is there or do you know some PFS-providing standards material that could serve me as a guideline that is written using only asymmetric ciphers, not using DH/eDH exchange?

Question variant: Given an asymmetric cipher with fast key generator, would implementing PFS be (roughly) as simple as this? --

  1. both sides generate asymmetric keypars
  2. each side sends its public key to the other side
  3. communication session happens using the private/public keys (probably with some rekeying to some faster (symmetric) cipher and authentication if we already weren't in authenticated channel, but we don't care about that now)
  4. all keys get erased

Bonus: If the above worked, would there be any security difference if each side could re-use its keypair several times (for efficiency or whatever) and made sure that the private gets deleted? Ofcourse supposing that the cipher is secure and ignoring the extended time window for key-stealing attack.

Thanks for guidelines/opinions! :]

EDIT: summary of what I'm trying to solve: I only have a very fast, CCA2-IND asymmetric encryption algorithm and want to build PFS with it. Is there a guide for that, so I don't need to make the obvious error by implementing my own crypto?

Improve this question
$\endgroup$
9
  • 3
    $\begingroup$ Source on the ECC RSA thing? From what I can find, it seems like ECC versions of RSA rely on the exact same problem as regular RSA (integer factorization), and so give no advantage over regular RSA (while ECDH is way better than DH for key size). Moreover, why don't you want to use DH/ECDH? Those basically are the standard for forward secrecy. $\endgroup$
    – cpast
    Apr 12 '15 at 21:59
  • $\begingroup$ This whole question is "triggered" by post-quantum fears, so I want to remove anything shor-algorithm-related from PFS, including ecc-DH and ecc-RSA. About the "ECC RSA thing", if you mean the key generation in milliseconds -- I might have overstated it a bit, but it's definately very fast. $\endgroup$
    – exa
    Apr 12 '15 at 22:42
  • 1
    $\begingroup$ AFAIK there are no post-quantum public-key standards period, since those algorithms are all too new for people to trust them yet. With ECC RSA -- the thing that makes ECDH key generation fast is that you can use a small key and be secure. RSA-like ECC schemes do not offer that; you still need a long key, which means key generation is no faster than normal RSA (a 256-bit ECC RSA key isn't 128 bits of security). $\endgroup$
    – cpast
    Apr 12 '15 at 23:39
  • 1
    $\begingroup$ ECC-RSA? Elliptic RSA variants? Do you mean algorithms such as ECDSA for signatures or ECIES for encryption? It seems the trick is in the authentication, not so much the key agreement. $\endgroup$
    – Maarten Bodewes ♦
    Apr 13 '15 at 11:18
  • $\begingroup$ possible duplicate of What is the post-quantum cryptography alternative to Diffie-Hellman? $\endgroup$
    – Maarten Bodewes ♦
    Apr 13 '15 at 11:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.