# How can I ensure forward secrecy when storing encrypted messages in a public blockchain?

I want to store encrypted sensitive messages in the blockchain.

I was thinking of using public-key cryptography to achieve this, but as the encrypted data will be stored forever in the blockchain and this data will still be sensitive 100 years from now I am afraid there will be a possibility in the future for people to break the encryption (using quantum computing for example).

Is there a way for me to achieve forward secrecy that will likely not be broken in the near future ?

Thank you

EDIT : I can tolerate a few messages being decrypted in the future (out of the tens of thousands I want to store), but I would like to keep that number as low as possible (less than 0.1%)

• Think about it as when key erasure happens, not as the property of forward secrecy. When does the last party who has the decryption key erase that key so that nobody has the decryption key? Look into asynchronous messaging protocols such as Signal to see how they answer this question—your use of a blockchain as a network medium makes no difference to the cryptography from, say, the use of a transatlantic internet backbone fiber cable over which the NSA and GCHQ might store all packets for future cryptanalysis. – Squeamish Ossifrage Jul 23 '17 at 16:49
• …this data will still be sensitive 100 years from now… – I sure hope you mean that theoretically. If not and you actually expect that practically, you should avoid any dependency on something that might not be around anymore in 100 years. Things evolve. To give you a perspective: 100 years ago (1917), real computers did not exist. Consequently, you should not expect that the blockchain and/or computers as we know them today will still exist in 100 years (2117). That is, except maybe in a museum for antique technologies and computing machines. Also, 100 years is hardly the near future. – e-sushi Jul 24 '17 at 0:39
• a one time pad only needs to double the footprint to ensure secrecy forever. – dandavis Jul 24 '17 at 4:58
• @SqueamishOssifrage I am not worried about the decryption key leaking as 1) it is not my role to keep it secret 2) it will only allow to decrypt a few messages if compromised. I am more worried about future ways of decrypting the messages without the need to steal the decryption key. "NSA and GCHQ might store all packets for future cryptanalysis", you are right, but these packets are not public so your sole attackers are these institutions whereas it could be anyone for public records such as a blockchain – Brendan Rius Jul 24 '17 at 13:30
• @e-sushi "you should not expect that the blockchain and/or computers as we know them today will still exist" - they might not be used or useful anymore but the data will very probably still be present and worth decrypting for some people so I cannot just ignore this problem – Brendan Rius Jul 24 '17 at 13:33