# What attacks does future secrecy protect against?

Consider messaging between 2 parties. A sequence of messages are exchanged between the parties using encryption. We consider an attacker that has at a minimum a log of all the (encrypted) messages sent between the two parties.

Forward Secrecy: encryption keys are constantly updated in a non-reversible way, this means that if the attacker gains key $$K_i$$ they can derive $$K_{i+1}$$, $$K_{i+2}$$ and so on and decrypt message $$M_i, M_{i+1}, M_{i+2}$$ but they cannot decrypt any previous messages.

Future Secrecy: Like the Axolotl double ratchet, both sides constantly generate new public/private key pairs and only the public parts are exchanged over the communication channel. This means that if the attacker gains private keys $$AK_i$$ and/or $$BK_i$$ they can decrypt a finite number of messages $$M_i$$ or maybe $$M_i, M_{i+1}$$ but they cannot decrypt any further messages. They also can't decrypt previous messages.

What I don't understand is the security value of future secrecy.

What kind of attack situation would future secrecy protect against?

It seems like an attacker would have to have exploited one of the messaging devices and read those temporary private keys from its memory - but then couldn't it just read the decrypted messages from memory and not bother with a cryptographic attack?

It seems like an attacker would have to have exploited one of the messaging devices and read those temporary private keys from its memory - but then couldn't it just read the decrypted messages from memory and not bother with a cryptographic attack?

It is assumed that the messaging devices erase the decrypted messages (and expired private keys) from memory, hence there's nothing to read.

• I see, thanks! so what kind of attack would future secrecy protect against? – rain1 Apr 15 at 16:37
• Theft of a device, for example. Leaking your current keys shouldn't reveal past communications, and systems designed to recover fast from leaks will protect future communications (such as by re-keying) – Natanael Apr 15 at 16:47
• @rain1: these are attacks where the attacker breaks into the device, learns the state of the device at the time, and then later tries to listen into the device communications. Now, it doesn't actually protect if the attacker is able to break into the device multiple times (while the communication that the attacker is interested in is happening), or if the attacker is able to modify the device (e.g. by spiking the device's entropy source, so that he can predict the future private keys) – poncho Apr 15 at 16:49