Does perfect forwarding secrecy, as used for e.g. the DHE_ and ECDHE_ TLS ciphersuites make it impossible for quantum analysis to retrieve the plaintext data within the connection?


1 Answer 1


No it does not.

Perfect forward secrecy implies that even if you retrieve the private key of the asymmetric key pair that you cannot read any of the past or future messages within a connection. It is only possible to derive the secret session keys of the session that you've retrieved the private key for.

Perfect forward secrecy - or forward secrecy for short - is obtained because the private key of all the parties of a connection can be destroyed after key agreement. That means it is required to regenerate the public/private key pair for each connection. These key pairs are called ephemeral key pairs and the key agreement is called ephemeral-ephemeral key agreement or just ephemeral key agreement for short. Authentication of the entities within the connection will be performed by other means (if at all), as the public key of a regenerated key pair cannot be trusted in advance.

Perfect forward secrecy however doesn't make it impossible to break DH or ECDH. It means that a leaked private key cannot be used to decrypt all recorded messages. It also means that you would have to perform an attack for each separate connection as you'd have to attack each separate key pair of one of the parties to retrieve the secret value. However, that doesn't make DH or ECDH perfectly secure; an equivalent to an asymmetric one-time-pad. If the DH or ECDH is attacked by a quantum computer then the private key or the shared key could be computed and the messages could be deciphered.

So regardless of (perfect) forward secrecy, the only way to make a transport protocol secure (against analysis with a quantum computer) is to use quantum safe cryptography (QSC) for key establishment. This usually requires post-quantum cryptographic (PQC) algorithms that cannot be analyzed using quantum computers. Either a PQC key agreement scheme or a PQC key encapsulation scheme could be used; both can provide quantum resistance.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.