# How can I ensure forward secrecy when storing encrypted messages in a public blockchain?

I want to store encrypted sensitive messages in the blockchain.

I was thinking of using public-key cryptography to achieve this, but as the encrypted data will be stored forever in the blockchain and this data will still be sensitive 100 years from now I am afraid there will be a possibility in the future for people to break the encryption (using quantum computing for example).

Is there a way for me to achieve forward secrecy that will likely not be broken in the near future ?

Thank you

EDIT : I can tolerate a few messages being decrypted in the future (out of the tens of thousands I want to store), but I would like to keep that number as low as possible (less than 0.1%)

• Think about it as when key erasure happens, not as the property of forward secrecy. When does the last party who has the decryption key erase that key so that nobody has the decryption key? Look into asynchronous messaging protocols such as Signal to see how they answer this question—your use of a blockchain as a network medium makes no difference to the cryptography from, say, the use of a transatlantic internet backbone fiber cable over which the NSA and GCHQ might store all packets for future cryptanalysis. – Squeamish Ossifrage Jul 23 '17 at 16:49
• …this data will still be sensitive 100 years from now… – I sure hope you mean that theoretically. If not and you actually expect that practically, you should avoid any dependency on something that might not be around anymore in 100 years. Things evolve. To give you a perspective: 100 years ago (1917), real computers did not exist. Consequently, you should not expect that the blockchain and/or computers as we know them today will still exist in 100 years (2117). That is, except maybe in a museum for antique technologies and computing machines. Also, 100 years is hardly the near future. – e-sushi Jul 24 '17 at 0:39
• a one time pad only needs to double the footprint to ensure secrecy forever. – dandavis Jul 24 '17 at 4:58
• @SqueamishOssifrage I am not worried about the decryption key leaking as 1) it is not my role to keep it secret 2) it will only allow to decrypt a few messages if compromised. I am more worried about future ways of decrypting the messages without the need to steal the decryption key. "NSA and GCHQ might store all packets for future cryptanalysis", you are right, but these packets are not public so your sole attackers are these institutions whereas it could be anyone for public records such as a blockchain – Brendan Rius Jul 24 '17 at 13:30
• @e-sushi "you should not expect that the blockchain and/or computers as we know them today will still exist" - they might not be used or useful anymore but the data will very probably still be present and worth decrypting for some people so I cannot just ignore this problem – Brendan Rius Jul 24 '17 at 13:33

As long as you use a post-quantum secure encryption scheme the fact that your messages are on the blockchain is not a problem. Traditionally adversaries are assumed to be capable of recording the traffic on an encrypted channel so theoretically they have always been allowed to keep messages for future decryption.

Currently the best way to get the necessary security is probably to use a symmetric scheme because their security is believed to only halve against a quantum computer. Or you pick your favorite post-quantum crypto scheme and combine it with a traditional one. For example Frodo is pretty conservative in its choices and in the paper the authors describe a combination with ECDHE.

Note that forward secrecy is not actually a property of the stored messages but is about the receiver of the message throwing away the key. The goal is that if somebody compromises the sender or receiver in the future they won't find a key that allows them do decrypt those old messages. In this case the difficult part is for the sender to know the current key. That's why this is only used in interactive protocols in which both parties exchange messages. Otherwise they can not agree on a shared secret without one party proposing it and thus having to encrypt it with some long term key.

• "Traditionally adversaries are assumed to be capable of recording the traffic" yes, but these adversaries are a very few governments/companies whereas the blockchain is public so anyone might try to decrypt the data. "Currently the best way to get the necessary security is probably to use a symmetric scheme because their security is believed to only halve against a quantum computer." do you have a source so I can read more about this? So you are saying the key to solving this problem is to use a secure key exchange protocol right? thanks – Brendan Rius Jul 24 '17 at 13:26
• I would upvote this post but I do not have the necessary reputation – Brendan Rius Jul 24 '17 at 13:35
• @BrendanRius Give it a bit of time until you received a few more upvotes (I dropped mine to help you a bit with that)… you'll be able to upvote posts soon. ;) – e-sushi Jul 24 '17 at 14:50
• @BrendanRius Unfortunately, I don't have a good source. Wikipedia might help a little: en.wikipedia.org/wiki/Grover%27s_algorithm The problem is that people haven't found better ways than Grover's algorithm to attack symmetric crypto with a quantum computer. – Elias Jul 24 '17 at 15:10
• Yes, a key exchange, specifically a key agreement would help. It would take a quantum computer (NOW) and a MitM attack to break the surrounding public key crypto. – Elias Jul 24 '17 at 15:11