Is it always a win or could PFS algorithms introduce new attack vectors or weaken the level of secrecy vs not being used?

  • 1
    $\begingroup$ Any new functionality can always contain (exploitable) bugs. Eg if you ECDHE engine has a bug whereas your RSA engine does not, this may weaken security if ECDHE is used. $\endgroup$
    – SEJPM
    Commented Oct 24, 2018 at 8:26

1 Answer 1


Yes, PFS could introduce new attack vectors.

PFS makes it hard to impossible to find / reconstruct a private key used for previous / future connections. It is not some special sauce that makes an algorithm invulnerable to attack.

Any change can always introduce vulnerabilities on an implementation level, as SEJPM already stipulated. This is also true on the protocol level, for instance it is possible to forget to authenticate the parameters, allowing for MitM attacks.

As for the algorithms used: well, it simply depends on the algorithms themselves. For ECDHE: you could forget to validate that a public point is on a curve for ECDHE. You must make sure that the security requirements for particular algorithms are met.

More broadly ECDHE is more vulnerable to attacks using quantum computers than RSA. So if quantum computers ever mature then a specific PFS algorithm could fall earlier than a previously used algorithm. However, you could also use finite field DHE for PFS and ECIES for "normal" key establishment, which would give the advantage to the PFS algorithm.

One pitfall is that servers may be more inclined to use smaller key sizes. Whereas a key in a RSA certificate is likely required to have a particular key size (by the Certificate Authority that needs to sign the certificate), nothing prevents a server to choose the smallest key size available for a protocol. For a long time DH implementations maximized the key size to 1024 bits, a key size that would be considered well below the minimum by now.

It might also be that the random number generator on the server could be bad. When using RSA encryption the pre-master secret is generated by the client. It could be that the server has a bad RNG and leaks information about the RNG state through the generated key pair. It may also use more random values and deplete the RNG of entropy. This again is more an implementation issue but it also shows that additional requirements may have to be met to support PFS algorithms.

Note that you asked for ways how PFS could weaken security. In general the advantages of PFS are very likely to outweigh the disadvantages. But if you ask a security professional to search for vulnerabilities you are likely to get a long list of possibilities, some more likely than others...


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.