Role of long-term asymmetric keys in a forward secrecy instant messaging protocol?

Question

I am trying to understand how forward secrecy works in general, using a simple instant messaging protocol as an example. Tell me if I have this process right or not:

1) Alice and Bob each generate a pair of long-term public and private keys, then verify public key fingerprints in person. The ONLY thing these keys will be used for is for authentication (signing messages, and signing things during session key exchange). These keys will NEVER be used for encryption of any kind.
2) Alice and Bob use a key exchange algorithm such as Diffie-Hellman in the clear, using the keys from step 1 only to authenticate one another during this process. They end up with a shared session key.
3) Alice sends Bob a message, encrypting it with a symmetric cipher using the session key negotiated in step 2.
4) Bob decrypts Alice's message using the key negotiated in step 2.
5) The process repeats for each new message sent, starting from step 2. Step 1 is never repeated.

Forward secrecy (by generating new session keys) ensures that past communications cannot be decrypted if the long-term private keys from step 1 are compromised, however, masquerading as Alice or Bob would be possible going forward if this occurred, possibly compromising all future messages.

Where have I gone wrong here? Thanks so much in advance!

Answer 1

I don't think you are wrong on any of the points.

"Perfect forward secrecy" is a confusing name. Indeed it means that somebody who gets hold of one of the keys cannot use it to decrypt messages from the past.

There are two more properties you usually want:

1. When somebody does impersonate Alice or Bob as you suggest this should cut the real partner out of the conversation to make it detectable.
2. When somebody acquires a key he should not be able to decrypt messages after Alice and Bob have switched to a new key. Sometimes called backward secrecy.

There are probably more that I didn't think of right now and it case of group messaging it becomes even more complicated. Dealing with these will make your steps (3.) - (5.) much more complex!

Answer 2

I'm editing a previous response I wrote here. Apologies if you read the other. I missed that you gave the context of a instant messaging protocol. Your process description is very different from how TLS implements forward secrecy.

At this point I'd just say that in your scenario, it is not necessary that each message use a new symmetric key. It's ok to do so, but not necessary for a FS guarantee. Once Alice and Bob have reached key agreement, they may continue to use that same key indefinitely. Alice and Bob each hold a secret that was used in constructing the common key. Those two secrets never cross the wire. As long as those two secrets remain secret, the encryption is secure. The only reason to generate a new secret would be if one party or the other was compromised, or lost the secret (perhaps due to device reboot.) It may be wise to generate a new secret from time to time, but it is not necessary to do it for every message. (TLS generates a new secret per session.)