I am trying to understand how forward secrecy works in general, using a simple instant messaging protocol as an example. Tell me if I have this process right or not:

1) Alice and Bob each generate a pair of long-term public and private keys, then verify public key fingerprints in person. The ONLY thing these keys will be used for is for authentication (signing messages, and signing things during session key exchange). These keys will NEVER be used for encryption of any kind.
2) Alice and Bob use a key exchange algorithm such as Diffie-Hellman in the clear, using the keys from step 1 only to authenticate one another during this process. They end up with a shared session key.
3) Alice sends Bob a message, encrypting it with a symmetric cipher using the session key negotiated in step 2.
4) Bob decrypts Alice's message using the key negotiated in step 2.
5) The process repeats for each new message sent, starting from step 2. Step 1 is never repeated.

Forward secrecy (by generating new session keys) ensures that past communications cannot be decrypted if the long-term private keys from step 1 are compromised, however, masquerading as Alice or Bob would be possible going forward if this occurred, possibly compromising all future messages.

Where have I gone wrong here? Thanks so much in advance!


I don't think you are wrong on any of the points.

"Perfect forward secrecy" is a confusing name. Indeed it means that somebody who gets hold of one of the keys cannot use it to decrypt messages from the past.

There are two more properties you usually want:

  1. When somebody does impersonate Alice or Bob as you suggest this should cut the real partner out of the conversation to make it detectable.
  2. When somebody acquires a key he should not be able to decrypt messages after Alice and Bob have switched to a new key. Sometimes called backward secrecy.

There are probably more that I didn't think of right now and it case of group messaging it becomes even more complicated. Dealing with these will make your steps (3.) - (5.) much more complex!

  • $\begingroup$ Thank you for the help. I am contributing my description to the Wikipedia article on forward secrecy, because it needs some work in my opinion. If anyone would like to help out and improve my description, cite sources, or expand the article, please do so: en.wikipedia.org/wiki/Forward_secrecy $\endgroup$ – steevven1 Feb 22 '18 at 14:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.