Does perfect forwarding secrecy, as used for e.g. the DHE_ and ECDHE_ TLS ciphersuites make it impossible for quantum analysis to retrieve the plaintext data within the connection?


No it does not.

Perfect forward secrecy implies that even if you retrieve the private key of the asymmetric key pair that you cannot read any of the past or future messages within a connection. It is only possible to derive the secret session keys of the session that you've retrieved the private key for.

Perfect forward secrecy - or forward secrecy for short - is obtained because the private key of all the parties of a connection regenerate the public/private key pair for each connection; authentication of the entities within the connection will be performed by other means (if at all). These key pairs are called ephemeral key pairs and the key agreement is called ephemeral-ephemeral key agreement or just ephemeral key agreement for short.

Perfect forward secrecy however doesn't make it impossible to break DH or ECDH. It just means that you would have to perform an attack for each separate connection as you'd have to attack each separate key pair of one of the parties to retrieve the secret value. It doesn't make DH or ECDH a perfect cipher, equivalent to an asymmetric one-time-pad.

So regardless of (perfect) forward secrecy, the only way to make a transport protocol secure (against analysis with a quantum computer) is to use quantum resistant cryptography - that is, post-quantum algorithms that cannot be analyzed using quantum computers.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.