# What do people mean when they talk about forward secrecy in ciphers?

I've heard several people and websites talk about ciphers that have forward secrecy. I know about forward secrecy in key agreement protocols, e.g. RLWE, (EC/SI)DH, QKD, etc. This could be what they're talking about and it's a simple case of misused terminology (I've mostly heard it in articles about cipher suites), but I've also heard this used in the context of hash based signature algorithms so I'm wondering if people are using a special variation of a stream cipher or some other method.

• Your title is about ciphers, which implies encryption, while your question text only mentions signatures. Could you please edit and make it just about signatures? Jul 22 '18 at 11:41
• I wasn't focusing on signatures. I was mentioning them as an example of an algorithm that looks like it shouldn't have forward secrecy but can. My main question is about forward secrecy in ciphers. Jul 22 '18 at 15:35

In this whitepaper (Perfect) Forward Security (or Secrecy) is defined as

a characteristic of an authenticated key exchange protocol which ensures that the disclosure of a long term identity key (such as a SSL Certificate or a SSH Host Key) does not compromise the confidentiality of the messages encrypted in sessions prior to the compromise. The session keys, or the short term encryption keys, are independent of the long term identity keys — although these session keys are authenticated by the identity keys. [...] Forward Security provides a layer of defense against the retroactive decryption of sessions in case of compromise of long term identity keys.

Please check the whitepaper if you are interested in the "subtle" difference between Forward Secrecy and Perfect Forward Secrecy.

I had my troubles too when I came across with these terms for the first time and as @poncho pointed out in his answer, most of them were due to the confusing terminology. I solved them with this "trick": forward secrecy refers to the security of my current session related to the future (so, forward) impairment of the long term key. I hope it helps!

What does 'forward secrecy' mean in the context of hash based signatures?

Well, what that term means is that we have a hash based signature scheme with an evolving key, that is, the private key is constantly being updated, and on a state compromise (at state $N$), you cannot get the private keys used prior to state $N$.

I personally don't see that as a good use of the term (it's feels like 'perfect reverse security' would be more apt terminology, as it's discussing the security of the system prior to compromise). However, that's what people mean by that terminology.

• My question was on ciphers, I just mentioned the hash signatures as an example of forward secrecy showing up in a non-trivial way. Jul 22 '18 at 15:36
• The quote in the answer doesn't come from the question text. Quotes should be precise. Jul 22 '18 at 17:43