# Is perfect forward secrecy (PFS) possible without public key cryptography

I have an understanding of PFS as used in most key agreement algorithms as well as things like TextSecure protocol and ratchets. My undestanding is that PFS is not possible without asymmetric (public key) cryptography. Am I missing something? Can PFS be achieved with symmetric cryptography and preshared keys only.

• You may be interested in eprint.iacr.org/2019/444.pdf (which appeared after the question here). The results in the paper itself are relevant but also the Related Work section is very extensive. Oct 22, 2020 at 8:45

Yes, perfect forward secrecy is possible using symmetric primitives alone.

Take for instance a set of one time pads:

1. Alice generates two identical stacks of one time pads and hands one of the stacks to Bob.
2. Alice encrypts a message with the first one time pad and then passes the ciphertext to Bob.
3. Bob decrypts the message with the first one time pad and then both Alice and Bob destroy the first one time pad. So long as all copies of the one time pad are destroyed the ciphertext is now undecipherable.
4. The next message is passed using the second one time pad and at the conclusion of that protocol round all copies of the second one time pad are destroyed. And so on.

This basic protocol achieves perfect forward secrecy.

Of course it's likely not a practical protocol for many applications as, for instance, it requires secure advance exchange of a set of one time pads and the message length is limited by the length of a one time pads which much be agreed in advance. Nevertheless you can start from this model and apply some basic cryptographic improvements such as:

• replace each one time pad with a key and a stream cipher so now we just need to exchange a set of keys
• replace the set of keys with a single key and a one way function to obtain the next key so now we just need one key (and of course you simply destroy the previous key each time you derive the next key).

It's not difficult obtain a relatively practical scheme assuming pre-shared keys. The security of this construction is not too difficult to bound (How secure is the stream cipher? How secure is the one way function?).

Yes, If in case your derived keys are not calculated from previous key. If you use a randomly generated key everytime, that would still gurantee PFS

• This is incorrect. You would still need asymmetric cryptography to exchange said key.
– forest
Aug 3, 2018 at 8:42
• If pre shared keys are exchanged out of band, it would still ensure PFS. DH is definitely used to PFS, but theoretically if Keys are exchanged without DH and any compromise of previous keys does not let future keys to be determined, it still means PFS. Aug 8, 2018 at 12:08

I have designed a protocol that tries to achieve PFS using ephemeral Diffie-Hellman key exchange, symmetric key cryptography, and hash function. Please check the attached image

Edit: $$R_A$$ and $$R_B$$ are Alice's and Bob's nonces respectively. $$K_{AB}$$ is a shared symmetric key between them, '$$a$$' and '$$b$$' are their respective chosen exponents, and '$$g$$' and '$$p$$' are publicly known. $$h$$ is the hash function. Here, after step 3, a session key would be generated and Alice and Bob will continue using their session key until the session ends.

P.s.: I would be happy to get corrected on this answer.

• Welcome to Cryptography. This is not an answer to the question. This should be a new question with more content about where it is needed and what are you trying to achive. Nov 9, 2022 at 6:46
• The solution proposed is with public key cryptography (where it uses $g^a\bmod p$) thus does not answer the question. Also I do not see that it yields PFS, in particular if $K_{AB}$ leaks.
– fgrieu
Nov 9, 2022 at 7:28

Technically no....

Diffe-Hellman isn't a public key algoritm but it does allow for key exchange. It is acually what is used in PFS... Public-key is not used to establish shared keys.

• Diffie-Hellman is certainly a public-key algorithm. Note that public-key cryptography includes more than just public-key encryption, it also incorporates key agreement (DH) and digital signatures. Aug 7, 2018 at 23:37